cp_mgmt_access_rule

Manages access-rule objects on Check Point over Web Services API through native controller HTTPAPI with owned sessions

Collection: check_point.mgmt

Full Name: check_point.mgmt.cp_mgmt_access_rule

Controller module — runs on the local controller, not on remote hosts.

Synopsis

Manages access-rule objects on Check Point over Web Services API through native controller HTTPAPI with owned sessions

Parameters

Name	Type	Required	Default	Description
action	str			a “Accept”, “Drop”, “Ask”, “Inform”, “Reject”, “User Auth”, “Client Auth”, “Apply Layer”.
action_settings	dict			Action settings.
auto_publish_session	bool		`false`	Publish this owned session explicitly after the operation; default false.
comments	str			Comments string.
content	list			List of processed file types that this rule applies on. Available from R80.10 management version.
content_direction	str			On which direction the file types processing is applied. Available from R80.10 management version.
content_negate	bool			True if negate is set for data. Available from R80.10 management version.
custom_fields	dict			Custom fields.
destination	list			Collection of Network objects identified by the name or UID.
destination_negate	bool			True if negate is set for destination.
details_level	str			The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed representation of the object.
enabled	bool			Enable/Disable the rule.
ignore_errors	bool			Apply changes ignoring errors. You won’t be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
ignore_warnings	bool			Apply changes ignoring warnings.
inline_layer	str			Inline Layer identified by the name or UID. Relevant only if “Action” was set to “Apply Layer”.
install_on	list			Which Gateways identified by the name or UID to install the policy on.
layer	str			Layer that the rule belongs to identified by the name or UID.
name	str	yes		Object name.
position	str			Position in the rulebase. The use of values “top” and “bottom” may not be idempotent.
relative_position	dict			Position in the rulebase. Use of this field may not be idempotent.
search_entire_rulebase	bool		`false`	Whether to search the entire rulebase for a rule that’s been edited in its relative_position field to make sure there indeed has been a change in its position or the section it might be in.
service	list			Collection of Network objects identified by the name or UID.
service_negate	bool			True if negate is set for service.
source	list			Collection of Network objects identified by the name or UID.
source_negate	bool			True if negate is set for source.
state	str		`present`	Desired object presence.
time	list			List of time objects. For example, “Weekend”, “Off-Work”, “Every-Day”.
track	dict			Track Settings. Available from R80.10 management version.
user_check	dict			User check settings.
version	str			Management API version path; omitted uses the default API version.
vpn	str			Any or All_GwToGw.
vpn_list	list			Communities or Directional.
wait_for_task	bool		`true`	Wait for returned asynchronous task identifiers; default true.
wait_for_task_timeout	int		`30`	Polling deadline in minutes; default 30, negative values use 30, maximum 1440.

Example

yaml

- name: add-access-rule
  check_point.mgmt.cp_mgmt_access_rule:
    layer: Network
    name: Rule 1
    position: 1
    service:
      - SMTP
      - AOL
    vpn: All_GwToGw
    state: present

- name: set-access-rule
  check_point.mgmt.cp_mgmt_access_rule:
    action: Ask
    action_settings:
      enable_identity_captive_portal: true
      limit: Upload_1Gbps
    layer: Network
    name: Rule 1
    state: present

- name: delete-access-rule
  check_point.mgmt.cp_mgmt_access_rule:
    layer: Network
    name: Rule 2
    state: absent