CheckPointSW / CheckPointAnsibleGAIACollection

An Ansible collection provides control over a Check Point machine using Check Point's web-services APIs.
20 stars 21 forks source link

static-route disappearing #44

Closed anousonevongsouvanTR closed 2 months ago

anousonevongsouvanTR commented 2 months ago

Hello, I have the following in my playbook below. When I run it for the first time, my routes show (clish show route) or expert (route command). However, when I run the playbook a second time, it seems like one route disappear from the live route table. However, in the configuration, the routes are present. For some reason, when I run for example a clish command - set static-route 192.168.5.0/24 nexthop gateway address 10.56.7.6 on after running my playbook, all the routes show up in the live route table. I am running R80.40 which is EOL, but need to run it for a few more months. API version 1.7.

duanetoler commented 2 months ago

Congratulations. You also discovered the ROUT-2393 issue [no E; just ROUT]. I reported this to TAC. They have custom hotfixes available for R81.20 JHF 26, 41, 53, and 54 (all of which I requested). Open a case, have them reference SR 6-0003821882 and SR 6-0003933035).

As for R80.40, however, there is no hotfix. There is a workaround. Add a new task after that which does an innocuous change, such as adding a comment to the route, then you can do another task to remove the comment. Alternatively, you can login with SSH and make the same innocuous change in CLISH:

set static-route default comment "FOO" set static-route default comment off

This hotfix is scheduled to be included in a future R81.20 Jumbo HFA "soon", they keep telling me.

As for the static-route Ansible module itself, it is also flawed, in several ways. No monitored IP tracking, you can't set priority and rank to "default", and a few others. I've opened TAC cases for this as well; they allege to have worked on it, but I can't tell if it will ever be fixed. They are silent on those details.

Stylistically, you don't have to write a JSON string for "next_hop". You can just write a usual YAML list:

  next_hop:
    - gateway: 10.56.7.1
anousonevongsouvanTR commented 2 months ago

Thanks for the detailed information Duane. Yeah, it was driving me nuts why the route show in the config, but not the live route table.

duanetoler commented 1 month ago

FYI: R81.20 JHF 70 now includes the ROUT-2393 hotfix for this issue! This hotfix was added to R81 and R81.10 earlier.