BETA — built and unit-tested, switched off until proven on a real Check Point device. One read-only administrator on the Security Management Server (or Smart-1 Cloud) gives SmartTile each Quantum gateway's trust and policy state, ClusterXL health, the installed rule base with a change history, policy backups, Jumbo Hotfix advisories and administrator activity.
/web_api) on a Security Management Server, Multi-Domain Server or Smart-1 Cloud — read-only session, API key or admin login — plus, optionally, each gateway's Gaia API (/gaia_api) with a read-only Gaia user.Check Point is managed centrally: one management server holds the policy for every gateway. So SmartTile connects to the management server, not to each box — one read-only administrator, one session per poll, every linked gateway read in it. The session is opened with Check Point's own read-only flag and SmartTile's client refuses to send anything but show-* commands. Beta: the platform switch and every company switch ship off; nothing is read until a SmartChoice super admin and the company's administrator both turn it on.
Every 5 minutes: SIC trust with the management server, whether the access policy is installed, ClusterXL state and members, and — with a Gaia login — CPU, memory, disk and interface link. Shown in the device's Check Point window.
Vendor, model, release with Jumbo take ("R81.20 Take 99"), serial, hostname and management MAC, written through the shared identity writer marked “Check Point Management / Gaia API”. Serial and MAC need the Gaia login.
Hourly, every access layer and the NAT rulebase of the installed policy package. Each rule added, removed, changed (which fields) or moved is logged in the Changes tab; the first read sets the baseline.
Config Backups capture the gateway object, its installed policy package and its VPN communities as one stable file, hashed and diffed like every other backup. Management-side configuration — not a Gaia OS backup.
When Check Point recommends a newer Jumbo take for the release a gateway already runs, FirmwareAutomate raises an advisory. Never a major-release jump; SmartTile never installs — it reads the running take afterwards.
AccessAutomate reads the management server's audit log (sign-ins) and published sessions (who published how many changes) for the last 24 hours.
“A Check Point gateway reports a problem” fires once when a problem opens — lost SIC, policy not installed, cluster member down, CPU 85%+, memory or disk 90%+, interface down, Jumbo recommended — never per poll.
The star and meshed communities each gateway belongs to, as configured. Check Point's APIs report no live tunnel state, so tunnels are listed, not watched.
smarttile-ro), Authentication Method API Key, Generate (shown once), Permission Profile Read Only All. Publish.157.245.117.9); Publish, then api restart. Smart-1 Cloud: copy the Web API URL from Infinity Portal → Settings → API & SmartConsole.| Company switch (all off) | What it turns on |
|---|---|
| A · Check Point integration | Health + identity every 5 min. Master: the others do nothing while it is off. |
| B · Rule inventory | Hourly access + NAT rules and the change ledger. |
| C · Config Backups | Policy package backups over the Management API. |
| D · Firmware advisories | Jumbo Hotfix advisories; a ticket only if your FirmwareAutomate ticketing is on. |
| E · AccessAutomate | Sign-ins and published changes. |
| F · Workflow events | One Workflow run per new problem. |
The session is opened with read-only: true and SmartTile's client refuses any command that is not show-*. It never publishes, installs policy, runs scripts or installs software.
The API key, admin password and Gaia password are sealed with AES-256-GCM, bound to their row and column, kept off the device record. The platform only returns “key set”.
A self-signed certificate is trusted by the SHA-256 fingerprint seen at Test; a different certificate is refused before the key is sent. Smart-1 Cloud uses normal CA checks.
A management server belongs to one company; a device can link only to its own company's server. Every route checks the caller's company; changes are admin-only and written to the activity log.
login · logoutread-only session (key or user), always closedshow-gateways-and-serversgateway list (Test), policy-install stateshow-simple-gateway · show-simple-cluster · show-cluster-memberSIC, version, membersshow-software-packages-per-targetsinstalled / recommended Jumbo takesshow-package · show-access-rulebase · show-nat-rulebaserule inventory, backupsshow-vpn-communities-star · -meshedVPN communitiesshow-logs (audit) · show-changes · show-taskAccessAutomateGaia: show-version · show-hostname · show-assetrelease, hostname, model, serialGaia: show-diagnostics · show-physical-interfaces · show-cluster-stateCPU, memory, disk, links, ClusterXL| Area | Today (beta) | Not yet |
|---|---|---|
| Proof | Unit-tested against Check Point's documented API examples. | Proven on a real gateway; then the platform switch goes on. |
| Up / down | Stays with SmartTile's ping / SNMP checks. | The API poller never marks a gateway down or opens an outage ticket. |
| Firmware | Jumbo takes on the running release (Central Deployment, R81.10+). | Major releases (APIs do not list them); installing. |
| VPN | Communities each gateway is in. | Live tunnel state / VPNAutomate — not in the APIs. |
| Backups | Management-side policy + objects. | A Gaia OS backup (CLI only). |
| Objection | Answer |
|---|---|
| “An API admin on our management server is a risk.” | Read Only All profile, a read-only session, and a client that only sends show-*. Delete the administrator to end it. |
| “Will it flood our ITSM system?” | Nothing alerts or tickets by itself. Workflow events and firmware ticketing are separate switches, off by default; a Workflow fires once per problem. |
| “We already have SmartConsole.” | Keep it. SmartTile puts the gateway next to your circuits, switches and access points, with a rule-change history and tickets where your team works. |