Try SpotterManages ACCESS LAYERS resource module
| "added in version" 5.0.0 of check_point.mgmt"
Authors: Ansible Security Automation Team (@justjais) <https://github.com/ansible-security>
This plugin has a corresponding action plugin.
Install with ansible-galaxy collection install check_point.mgmt:==5.2.3
collections:
- name: check_point.mgmt
version: 5.2.3This resource module allows for addition, deletion, or modification of CP Access Layers.
This resource module also takes care of gathering Access layer config facts
# Using MERGED state
# -------------------
- name: Merge Access-layer config
cp_mgmt_access_layers:
state: merged
config:
name: New Layer 1
add_default_rule: true
applications_and_url_filtering: true
content_awareness: true
detect_using_x_forward_for: false
firewall: true
implicit_cleanup_action: drop
mobile_access: true
shared: false
tags:
- test_layer
color: aquamarine
comments: test description
details_level: full
ignore_warnings: false
ignore_errors: false
round_trip: true
# RUN output:
# -----------
# mgmt_access_layers:
# after:
# applications_and_url_filtering: true
# color: aquamarine
# comments: test description
# content_awareness: true
# detect_using_x_forward_for: false
# domain: SMC User
# firewall: true
# icon: ApplicationFirewall/rulebase
# implicit_cleanup_action: drop
# mobile_access: true
# name: New Layer 1
# shared: false
# tags:
# - test_layer
# uid: eb74d7fe-81a6-4e6c-aedb-d2d6599f965e
# before: {}
# Using REPLACED state
# --------------------
- name: Replace Access-layer config
cp_mgmt_access_layers:
state: replaced
config:
name: New Layer 1
add_default_rule: true
applications_and_url_filtering: true
content_awareness: false
detect_using_x_forward_for: false
firewall: true
implicit_cleanup_action: drop
mobile_access: true
shared: true
tags:
- test_layer_replaced
color: cyan
comments: test REPLACE description
details_level: full
ignore_warnings: false
ignore_errors: false
round_trip: true
# RUN output:
# -----------
# mgmt_access_layers:
# after:
# applications_and_url_filtering: true
# color: cyan
# comments: test REPLACE description
# content_awareness: false
# detect_using_x_forward_for: false
# domain: SMC User
# firewall: true
# icon: ApplicationFirewall/sharedrulebase
# implicit_cleanup_action: drop
# mobile_access: true
# name: New Layer 1
# shared: true
# tags:
# - test_layer_replaced
# uid: a4e2bbc1-ec94-4b85-9b00-07ad1279ac12
# before:
# applications_and_url_filtering: true
# color: aquamarine
# comments: test description
# content_awareness: true
# detect_using_x_forward_for: false
# firewall: true
# icon: ApplicationFirewall/rulebase
# implicit_cleanup_action: drop
# mobile_access: true
# name: New Layer 1
# shared: false
# tags:
# - test_layer
# Using GATHERED state
# --------------------
# 1. With Round Trip set to True
- name: Gather Access-layers config by Name
cp_mgmt_access_layers:
state: gathered
config:
name: New Layer 1
round_trip: true
# RUN output:
# -----------
# gathered:
# applications_and_url_filtering: true
# color: aquamarine
# comments: test description
# content_awareness: true
# detect_using_x_forward_for: false
# domain: SMC User
# firewall: true
# icon: ApplicationFirewall/rulebase
# implicit_cleanup_action: drop
# mobile_access: true
# name: New Layer 1
# shared: false
# tags:
# - test_layer
# uid: eb74d7fe-81a6-4e6c-aedb-d2d6599f965e
# 2. With Round Trip set to False which is the default behaviour
- name: Gather Access-layers config by Name
cp_mgmt_access_layers:
state: gathered
config:
name: New Layer 1
# RUN output:
# -----------
# gathered:
# applications_and_url_filtering: true
# color: turquoise
# comments: test description
# content_awareness: true
# detect_using_x_forward_for: false
# domain:
# domain-type: domain
# name: SMC User
# uid: 41e821a0-3720-11e3-aa6e-0800200c9fde
# firewall: true
# icon: ApplicationFirewall/rulebase
# implicit_cleanup_action: drop
# meta-info:
# creation-time:
# iso-8601: 2022-11-21T07:34+0000
# posix: 1669016073937
# creator: admin
# last-modifier: admin
# last-modify-time:
# iso-8601: 2022-11-21T07:34+0000
# posix: 1669016074765
# lock: unlocked
# validation-state: ok
# mobile_access: true
# name: New Layer 1
# read-only: false
# shared: false
# tags:
# - domain:
# domain-type: domain
# name: SMC User
# uid: 41e821a0-3720-11e3-aa6e-0800200c9fde
# name: test_layer
# type: tag
# uid: 22cc8b0d-984f-47de-b1f6-276b3377eb0c
# type: access-layer
# uid: a54e47d3-22fc-4aff-90d9-f644aa4a1522
# 3. Gather ALL threat-layer config with DESC order filter
- name: To Gather ALL access-layer and order by Name
cp_mgmt_access_layers:
config:
order:
- DESC: name
state: gathered
# RUN output:
# -----------
# gathered:
# - domain:
# domain-type: domain
# name: SMC User
# uid: 41e821a0-3720-11e3-aa6e-0800200c9fde
# name: New Layer 1
# type: access-layer
# uid: a54e47d3-22fc-4aff-90d9-f644aa4a1522
# - domain:
# domain-type: domain
# name: SMC User
# uid: 41e821a0-3720-11e3-aa6e-0800200c9fde
# name: Network
# type: access-layer
# uid: 63b7fe60-76d2-4287-bca5-21af87337b0a
# Using DELETED state
# -------------------
- name: Delete Access-layer config by Name
cp_mgmt_access_layers:
state: deleted
config:
name: New Layer 1
state:
choices:
- merged
- replaced
- gathered
- deleted
description:
- The state the configuration should be left in
- The state I(gathered) will get the module API configuration from the device and
transform it into structured data in the format as per the module argspec and the
value is returned in the I(gathered) key within the result.
type: str
config:
description: A dictionary of ACCESS LAYERS options
suboptions:
add_default_rule:
description: Indicates whether to include a cleanup rule in the new layer.
type: bool
applications_and_url_filtering:
description: Whether to enable Applications & URL Filtering blade on the layer.
type: bool
auto_publish_session:
description:
- Publish the current session if changes have been performed after task completes.
type: bool
color:
choices:
- aquamarine
- black
- blue
- crete blue
- burlywood
- cyan
- dark green
- khaki
- orchid
- dark orange
- dark sea green
- pink
- turquoise
- dark blue
- firebrick
- brown
- forest green
- gold
- dark gold
- gray
- dark gray
- light green
- lemon chiffon
- coral
- sea green
- sky blue
- magenta
- purple
- slate blue
- violet red
- navy blue
- olive
- orange
- red
- sienna
- yellow
description: Color of the object. Should be one of existing colors.
type: str
comments:
description: Comments string.
type: str
content_awareness:
description: Whether to enable Content Awareness blade on the layer.
type: bool
details_level:
choices:
- uid
- standard
- full
description: The level of detail for some of the fields in the response can vary
from showing only the UID value of the object to a fully detailed representation
of the object.
type: str
detect_using_x_forward_for:
description: Whether to use X-Forward-For HTTP header, which is added by the proxy
server to keep track of the original source IP.
type: bool
firewall:
description: Whether to enable Firewall blade on the layer.
type: bool
ignore_errors:
description: Apply changes ignoring errors. You won't be able to publish such
a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
type: bool
ignore_warnings:
description: Apply changes ignoring warnings.
type: bool
implicit_cleanup_action:
choices:
- drop
- accept
description: The default "catch-all" action for traffic that does not match any
explicit or implied rules in the layer.
type: str
limit:
description:
- The maximal number of returned results.
- NOTE, this parameter is a valid parameter only for the GATHERED state, for config
states like, MERGED, REPLACED, and DELETED state it won't be applicable.
type: int
mobile_access:
description: Whether to enable Mobile Access blade on the layer.
type: bool
name:
description: Object name. Must be unique in the domain.
type: str
offset:
description:
- Number of the results to initially skip.
- NOTE, this parameter is a valid parameter only for the GATHERED state, for config
states like, MERGED, REPLACED, and DELETED state it won't be applicable.
type: int
order:
description:
- Sorts results by the given field. By default the results are sorted in the ascending
order by name. This parameter is relevant only for getting few objects.
- NOTE, this parameter is a valid parameter only for the GATHERED state, for config
states like, MERGED, REPLACED, and DELETED state it won't be applicable.
elements: dict
suboptions:
ASC:
description:
- Sorts results by the given field in ascending order.
type: str
DESC:
description:
- Sorts results by the given field in descending order.
type: str
type: list
round_trip:
description:
- If set to True, the round trip will filter out the module parameters from the
response param, which will enable the user to fire the config request using
the structured gathered data.
- NOTE, this parameter makes relevance only with the GATHERED state, as for config
states like, MERGED, REPLACED, and DELETED state it won't make any config updates,
as it's not a module config parameter.
type: bool
shared:
description: Whether this layer is shared.
type: bool
tags:
description: Collection of tag identifiers.
elements: str
type: list
version:
description:
- Version of checkpoint. If not given one, the latest version taken.
type: str
type: dict
after:
description: The resulting configuration after module execution.
returned: when changed
sample: 'This output will always be in the same format as the module argspec.
'
type: dict
before:
description: The configuration prior to the module execution.
returned: when state is I(merged), I(replaced), I(deleted)
sample: 'This output will always be in the same format as the module argspec.
'
type: dict
gathered:
description: Facts about the network resource gathered from the remote device as
structured data.
returned: when state is I(gathered)
sample: 'This output will always be in the same format as the module argspec.
'
type: dict