Script to Restart Remote Gateways

[terri8369]

We recently upgraded from 77.30 to 80.10. We have a VPN community with about 100 remote devices (a mix of 1100's and 1430's all on 75 or higher). I need to reboot all these devices, and would like to do so with a script in the wee hours of the morning. I was able to use provisioning in 77.30 to do this, but have not found a way to do it in 80.10. Is it possible? Any assistance is greatly appreciated. --terri

[cciesec2006]

We recently upgraded from 77.30 to 80.10. We have a VPN community with about 100 remote devices (a mix of 1100's and 1430's all on 75 or higher). I need to reboot all these devices, and would like to do so with a script in the wee hours of the morning. I was able to use provisioning in 77.30 to do this, but have not found a way to do it in 80.10. Is it possible? Any assistance is greatly appreciated. --terri

I don't have 1100 or 1430 so I don't have experiences with them. if they are the same as checkpoint running on open servers, I would do something like this:

1- have a centralized linux system for administration purposes,
2- place the public key of this linux server to all the checkpoint appliances,
3- write a tiny bash scripts to allow the linux server to ssh into the checkpoint appliances and perform the reboot,
4- put in a cron job on the linux server to perform the reboot at the appropriate time,

That will do the trick for you.

[jflemingeds]

We recently upgraded from 77.30 to 80.10. We have a VPN community with about 100 remote devices (a mix of 1100's and 1430's all on 75 or higher). I need to reboot all these devices, and would like to do so with a script in the wee hours of the morning. I was able to use provisioning in 77.30 to do this, but have not found a way to do it in 80.10. Is it possible? Any assistance is greatly appreciated. --terri

# From MGMT server / CMA
cprid_util -server $IP -verbose rexec -rcmd bash -c 'reboot'

I don't remember if the reboot command will ask you if your sure or not. This should work on SMB or normal gaia.

if you make a list of IPs to do this on it would be something like this (assuming firewalls listed in fws.txt with each line only containing a hostname or IP)

for x in $(cat $fws.txt) ; do cprid_util -server $x -verbose rexec -rcmd bash -c 'reboot' ; done

That may not be %100 but it should be very close. I would test with issuing the hostname command first.

ssh key auth work also well, however checkpoint made that.. hmm... interesting on the SMB line because "/" isn't owned by root among other things. ssh key auth is generally a pain there.

[cciesec2006]

# From MGMT server / CMA
cprid_util -server $IP -verbose rexec -rcmd bash -c 'reboot'

I don't remember if the reboot command will ask you if your sure or not. This should work on SMB or normal gaia.

if you make a list of IPs to do this on it would be something like this (assuming firewalls listed in fws.txt with each line only containing a hostname or IP)

for x in $(cat $fws.txt) ; do cprid_util -server $x -verbose rexec -rcmd bash -c 'reboot' ; done

That may not be %100 but it should be very close. I would test with issuing the hostname command first.

ssh key auth work also well, however checkpoint made that.. hmm... interesting on the SMB line because "/" isn't owned by root among other things. ssh key auth is generally a pain there.

it works on GAIA, didn't ask for "are you sure"
[Expert@P1:0]# mdsenv 192.168.1.1
[Expert@P1:0]# cprid_util -server 192.168.1.2 -verbose rexec -rcmd bash -c 'reboot'