StoneBlog.stonesoft.com

This post is shedding some light on two kinda hidden binaries in StoneGate directory, since they can be very useful for automation operation like the one I described in a previous post.

The tools are named sgImport.[bat|sh] and sgExport.[bat|sh].

Both located in <StoneGate_install_dir>/bin/, they can be used to export and import elements from StoneGate (hence their name ).

The nice feature is that they both work with zipped XML files, allowing some very fast object manipulation in StoneGate for different purposes, like:

• quick definition of large number of similar objects (e.g. Network Elements, Firewalls and IPS Engines)
• interaction with external processes like Web Forms, other scripts, applications
• modification of existing elements without accessing the GUI

The usage guidelines can be obtained by issuing the script with –h parameter and this is an example with sgExport.sh on a Linux box:

StoneGate Management Center (4.3.5 [7944])
Copyright 2000-2009 Stonesoft Corp. All rights reserved.
http://www.stonesoft.com
STONEGATE IMPORT/EXPORT

XML Export command syntax:
[-h|--help] [-host <ipaddress>] [-login <login>]
[-password <password>] [-file <resultFilePath>]
[-type <all|nw|ips|sv|rb|al>] [-recursion]
-h | –help: displays the help message,
-host <ipaddress>: specifies the ip address of the Management Server (by default: localhost),
-login <login>: specifies the login of an SMC Administrator,
-password <password>: specifies the password of the SMC Administrator,
-file <resultFilePath>: specifies the zip result file path,
-type <all|nw|ips|sv|rb|al|vpn>: exports all: All Elements; nw: Network Elements; ips: IPS Elements;
sv: Services; rb: Security Policies; al: Alerts; vpn: VPN Elements,
-recursion: activates the recursive export (also referenced objects are exported).
-system: export also system elements.

As you might know, XML files can be quite complex depending how the software they are used with is structured.

To maintain an operational consistency, if you wish to use such feature I’m recommending to act as follows:

1. locate/define in StoneGate configuration an object of the type you’re interested in
2. use GUI export element tool or sgExport to export the zipped XML file
3. manipulate the exported XML file depending on usage
4. recreate the zipped XML file and use sgImport or GUI menu to reimport it in StoneGate

Using the procedure above, you ensure consistency and correctness of the item imported.

Since power is nothing without control StoneGate import process will however validate the file while importing it and will return an error in case it’s missing anything.

Stay tuned, as I’ll publish soon example of practical usage of this very handy StoneGate feature.

written by RoarinPenguin - 1,338 views \\ tags: export, import, script, sgExport, sgImport, xml

Want to share with you a quick yet powerful way to create objects in StoneGate, taking advantage of flexibility of bundled commands to export and import elements.

For a test I was doing few days ago, I had the need of creating quickly a quite big number of objects. Done that, I needed to reference them in an alias to manage efficiently a rulebase that could be published to many different firewalls simultaneously, changing value of the element depending on which firewall it is installed on (that is, the beautiful power of StoneGate Aliases).

Here’s what I’ve done (on a Linux based SMC).

Continue reading »

written by RoarinPenguin - 1,732 views \\ tags: alias, configuration, multiple elements, script, xml