Suppose, hypothetically, that you had super admin access to a CMA in SmartConsole v 80.40, but lacked ssh or GUI access to firewalls within that CMA? What could you do? Can you run commands in a pinch? Yes. You can. Here are some concrete examples.
In the servers section of the domain you can right-click and choose “Run one-time script.” That’s great, but I think there are limits. It will time out a script that takes too long. IDK, maybe 10 seconds or so is the maximum time allowed. The returned text gets truncated if it’s too long. 15 lines of text is OK. 200 is not. Somewhere inbetween those two is the limit.
Running clish commands
clish commands can indeed be run this way. I was interested in examining a few routes on a firewall with many static routes. I ran:
netstat -rn|grep 198.23|head -15
Set a static route
clish -sc “set static-route 220.127.116.11/24 nexthop gateway address 10.23.42.10 on”
Redistribute this route via BGP
clish -sc “set route-redistribution to bgp-as 38002.48928 from static-route 18.104.22.168/24 on”
Run a PING (best to restrict the number of ping packets)
ping -c3 22.214.171.124
Show a part of configuration, e.g., BGP stuff
clish -c “show configuration”|grep bgp|head -15
Real firewall admins I know fail to realize that even when they lack shell access to a firewall they can pretty issue any command they need if they use the one-time script option in SmartConsole. It just helps to follow along the lines of the examples above – limiting output, etc. Even clish config changes can be made! A common reason to be in this situation is to learn someone changed a password or cleaned up old accounts.