Solved: custom-script example for autoprovision of autosca... - Check Point CheckMates

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

1 Solution

Accepted Solutions

Advisor

‎2020-11-1710:58 PM

Show option menu

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

In response to H4ppyM3

View solution in original post

no, you should run directly clish -s -c 'set static-route' inside of provisioning script.

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

13 Replies

Contributor

‎2019-03-0111:35 PM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Hi Javier,

thanks a lot!

So this script is for changing parts of the gateway objects.

Am I'm correct, that if I need to change parts in GAIA, I have to configure a bootstrap file? - like for adding different routes, adding users....?

How can I change or add this bootstrap file to an already existing VMSS? I mean, that future deployed (dynamic) gateways would have this settings?

1\ \ \ Kudo

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Javier_Hijas

Employee Alumnus

‎2019-03-0410:12 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

https://github.com/CheckPointSW/sddc

Hi Carsten! Instead of using the azure bootstrap options, the way for VMSS is to use the same autoprovision configuration file at the Check Point management server. These custom settings are described in the following doc:

HTHs,

Kudos

In response to Javier_Hijas

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Abhishek_Singh1

Contributor

‎2019-09-2404:13 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Hi @Javier_Hijas , I am working on deploying a VMSS with MTA enabled on the Gateway firewall. Do you have any recommendation or experience with the same?? Any specific flag or setting on the custom script that I can use for the gateways being spinup by the VMSS.

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Contributor

‎2019-03-0507:37 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Thank you, but how do I use the script?

How looks the CLI syntax?

#> python monitor.pv file.json

...does not work

2\ \ \ Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Contributor

‎2019-03-1406:21 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

In response to Carsten_R

Hi,

is there no solution or aren't there any examples how to execute the script?

1\ \ \ Kudo

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Advisor

‎2019-10-0707:14 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

In response to Carsten_R

Hi Carsten

for each template you can specify custom gateway script, like this:

autoprov-cfg set template -tn <templateName -cg "/home/admin/myscript.sh"

"Intranet": {

"application-control": true,

"custom-gateway-script": "/home/admin/myscript.sh",

and script can look like this:

#!/bin/bash

. /tmp/.CPprofile.sh

cd /home/admin/

echo "Downloanding config file..."

curl_cli -k -O https://10.223.227.31/azure.txt

clish -i -f /home/admin/config-azure.txt

In our case i've use it for rolling out system level settings per our standards and static routes..

2\ \ \ Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Contributor

‎2019-12-0306:07 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Hi Martin,

thanks, but where do I find the "-cg" option?

[...]

[Expert@cpmgmt:0]# autoprov-cfg init Azure -tn "autoprovisioning_template" -h

usage: autoprov-cfg init Azure [-h] -mn MANAGEMENT NAME -tn TEMPLATE NAME -otp

ONE TIME PASSWORD -ver

{R77.30,R80.10,R80.20,R80.30,R80.40} -po POLICY

-cn CONTROLLER NAME -sb SUBSCRIPTION

[-at SERVICE PRINCIPAL CREDENTIALS TENANT]

[-aci SERVICE PRINCIPAL CREDENTIALS CLIENT ID]

[-acs SERVICE PRINCIPAL CREDENTIALS CLIENT SECRET]

[-au AZURE USERNAME] [-ap AZURE PASSWORD]

[...]

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Advisor

‎2019-12-0306:17 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

In response to Carsten_R

Hi, once you do init, you can then do "set template -tn abc -cg /home/script.sh"

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

H4ppyM3

Contributor

‎2020-11-1612:10 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Hi Martin,

can you share the script which you are using for adding routes ?

thanks.

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Advisor

‎2020-11-1612:14 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

In response to H4ppyM3

normally via "set static-route" command, those lines are part of script, which is run on gateway during provisioning.

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

H4ppyM3

Contributor

‎2020-11-1706:52 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Hi Martin,

thank you for reply. So the steps should looks like this:

In /home/admin directory I add a txt file "add_route.txt" with command inside:

set static-route 192.168.0.0/24 nexthop gateway address 10.0.0.1

Create a script run.sh

!/bin/bash

. /tmp/.CPprofile.sh

clish -i -f /home/admin/add_route.txt

autoprov-cfg set template -tn -cg "/home/admin/run.sh

This will add a route to the gateway each time scaling occur ? right ?

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Advisor

‎2020-11-1710:58 PM

no, you should run directly clish -s -c 'set static-route' inside of provisioning script.

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

H4ppyM3

Contributor

‎2020-11-1903:10 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

it works. thank you Martin 🙂

Kudos

Part 1 How CloudGuard Controller R82.10 Builds Dynamic Security Context

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Post Reply

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

User	Count
WiliRGasparetto	13
Jeff_Engel	1
jorgeluiznim	1

View All ≫

Trending Discussions

Identity Distribution, TTL, Monitoring, and Operations in CloudGuard Controller R82.10

Known R82.10 Limitations That Affect Architecture The current R82.10 documentation lists limitati

Upcoming Events

Sort by:

Under the Hood - Check Point and Illumio – Modern Network Defense Against AI-Based Threats

Tue 28 Jul 2026 @ 11:00 AM (EDT)

The AI Security Report 2026: A Turning Point for Enterprise Defense - SGT

Wed 29 Jul 2026 @ 12:00 PM (SGT)

The AI Security Report 2026: A Turning Point for Enterprise Defense - AMER

Wed 29 Jul 2026 @ 02:00 PM (IDT)

The AI Security Report 2026: A Turning Point for Enterprise Defense EMEA

Wed 29 Jul 2026 @ 03:00 PM (CEST)

TechTalk: On-Premise SD-WAN Management

Wed 29 Jul 2026 @ 11:00 AM (EDT)

Thu 30 Jul 2026 @ 11:30 AM (CDT)

CheckMates Live DFW: Agentic AI Security Deep Dive & Hands-On

Tue 28 Jul 2026 @ 11:00 AM (EDT)

Wed 29 Jul 2026 @ 12:00 PM (SGT)

Wed 29 Jul 2026 @ 02:00 PM (IDT)

Wed 29 Jul 2026 @ 03:00 PM (CEST)

TechTalk: On-Premise SD-WAN Management

Wed 29 Jul 2026 @ 11:00 AM (EDT)

AI Security Masters E12: READY OR NOT: Securing the AI Enterprise 4/5 - AI Gateway

Thu 30 Jul 2026 @ 10:00 AM (PDT)

New York City: Agentic AI Security Deep Dive & Hands-On

Tue 11 Aug 2026 @ 11:30 AM (EDT)

Waltham, MA: Agentic AI Security Deep Dive & Hands-On

Thu 13 Aug 2026 @ 11:30 AM (EDT)

Medellin: Workspace Evolution: Hybrid Mesh Management - Visibilidad, Automatización e IA

Thu 20 Aug 2026 @ 08:30 AM (COT)

Medellin: Workspace Intelligence: IA Generativa en Acción para Equipos de Seguridad

Thu 20 Aug 2026 @ 06:00 PM (COT)

Check Point Hands-On SASE and Cloud Workshop - Zurich

Thu 27 Aug 2026 @ 09:00 AM (CEST)