topic Re: FMC API Move rule to another category/section in DevNet Sandbox

FMC API Move rule to another category/section

VladAndrei — Thu, 07 Mar 2024 10:32:08 GMT

Hello!

I am trying to move a rule to a category/section via the API, but I'm not sure how to do it via the PUT endpoint. I have tried this:

PUT with partialUpdate=True with following payload:

{"metadata": {"category":"test_category"}, "id":rule_id}

Response:

code 422, text: Unprocessable Entity - Unrecognized Field 'category' in request payload

PUT with partialUpdate=True with following payload:

json_body={"category":"test_category", "id":rule_id}

Response:

code 200, OK

But the category is not changed. The rule remains in its original position on the FMC.

I have also tried specifying category and automation in the PUT endpoint like so:

api/fmc_config/v1/domain/{domain}/policy/accesspolicies/{policy}/accessrules/{rule_id}?bulk=false&partialUpdate=true&category=test_category

but I get status code 400 with the following error: Invalid query parameter for the PUT operation.

The only option I could think of is to delete the rule and recreate it with the POST endpoint which allows me to specify category/section, but that would mean the comment history list would be lost.

We are using FMC 7.2.4-169

Re: FMC API Move rule to another category/section

Alexander Stevenson — Thu, 07 Mar 2024 13:48:45 GMT

As far as I can tell, moving an existing access control rule to a different category through the Cisco FMC API is not directly supported via a simple API call. The API doesn't provide a straightforward method to change the category of a rule without deleting and recreating it. This would explain the error messages you're receiving: the category field may not be recognized or modifiable through the API for an existing rule.

You will get better results if you search/ask about FMC in the Network Security forum: https://community.cisco.com/t5/network-security/bd-p/disc-network-security
Check out the Docs: https://www.cisco.com/c/en/us/td/docs/security/firepower/70/api/REST/firepower_management_center_rest_api_quick_start_guide_70/About_The_Firepower_Management_Center_REST_API.html
Reach out to Cisco Support: Since this seems to be a limitation of the API, contacting Cisco TAC (Technical Assistance Center) might provide you with the latest information or workarounds specific to your FMC version: https://www.cisco.com/c/en/us/support/index.html

Re: FMC API Move rule to another category/section

KRVE — Wed, 15 May 2024 09:58:45 GMT

Same issue, it does not seems to be possible to change the metadata. Changing the name and other parameters work fine, but nothing in the metadata.

I was hoping my script could change the category of all rules to have some kind of structure, but we will need to use the bulk edit in the GUI.