topic Re: FTD - DHCPRelayService in Network Security

FTD - DHCPRelayService

kscholz — Fri, 15 Dec 2023 12:21:31 GMT

Hello,

via API-Explorer with put dhcprelayservices working fine, but per ansible i get only first value but no server and agent records.

Code via API-Explorer is working:

{ "version": "m2l3jneotn6e4", "name": "NAME_DHCP-RELAY-SERVER", "ipv4RelayTimeout": 60, "ipv6RelayTimeout": 60, "servers": [ { "server": { "type": "networkobject", "name": "IPv4_DHCP1" }, "interface": { "type": "subinterface", "name": "Interfacename who the dhcp running" }, "type": "dhcprelayserver" }, { "server": { "type": "networkobject", "name": "IPv4_DHCP2" }, "interface": { "type": "subinterface", "name": "Interfacename who the dhcp running" }, "type": "dhcprelayserver" } ] "agents": [ { "enableIpv4Relay": true, "enableIpv6Relay": false, "setRoute": false, "interface": { "type": "subinterface", "name": "Interface-Name" }, "type": "dhcprelayagent" }, { "enableIpv4Relay": true, "enableIpv6Relay": false, "setRoute": false, "interface": { "type": "subinterface", "name": "Interface-Name" }, "type": "dhcprelayagent" } ] "type": "dhcprelayservice" } }

Ansible code (all ID values are read before this script is executed):

--- - name: Execute upsertDHCPRelayService operation M-NET HB ftd_configuration: operation: upsertDHCPRelayService data: version: "{{ dhcprelay.version }}" name: NAME_DHCP-RELAY-SERVER description: "NAME_DHCP-RELAY-SERVER" ipv4RelayTimeout: 60 ipv6RelayTimeout: 60 servers[0]: [ {"server": {"type": "networkobject","name": "IPv4_dhcpserver1"},"interface": {'type':'subinterface','id':'{{ subinterface_interfaceX.id }}' },"type": "dhcprelayserver"} ] servers[1]: [ {"server": {"type": "networkobject","name": "IPv4_dhcpserver2"},"interface": {'type':'subinterface','id':'{{ subinterface_interfaceX.id }}' },"type": "dhcprelayserver"} ] agents[0]: [ {"enableIpv4Relay": true,"enableIpv6Relay": false,"setRoute": false,"interface": {'type':'subinterface','id':'{{ subinterface_interfaceX.id }}' },"type": "dhcprelayagent"} ] agents[1]: [ {"enableIpv4Relay": true,"enableIpv6Relay": false,"setRoute": false,"interface": {'type':'subinterface','id':'{{ subinterface_interfaceX.id }}' },"type": "dhcprelayagent"} ] agents[2]: [ {"enableIpv4Relay": true,"enableIpv6Relay": false,"setRoute": false,"interface": {'type':'subinterface','id':'{{ subinterface_interfaceX.id }}' },"type": "dhcprelayagent"} ] agents[3]: [ {"enableIpv4Relay": true,"enableIpv6Relay": false,"setRoute": false,"interface": {'type':'subinterface','id':'{{ subinterface_interfaceX.id }}' },"type": "dhcprelayagent"} ] agents[4]: [ {"enableIpv4Relay": true,"enableIpv6Relay": false,"setRoute": false,"interface": {'type':'subinterface','id':'{{ subinterface_interfaceX_f.id }}' },"type": "dhcprelayagent"} ] type: dhcprelayservice

If a use no number by server and agents, then i get follow error by ansible.

"msg": { "Invalid data provided": { "required": [ "servers[0].server.id", "servers[1].server.id"

Ansible-Output:

changed: [ftd-name] => { "ansible_facts": {}, "changed": true, "invocation": { "module_args": { "data": { "agents[0]": [ { "enableIpv4Relay": true, "enableIpv6Relay": false, "interface": { "id": "39f2769f-9062-11ee-8f5f-9fdadd220530", "type": "subinterface" }, "setRoute": false, "type": "dhcprelayagent" } ], "agents[1]": [ { "enableIpv4Relay": true, "enableIpv6Relay": false, "interface": { "id": "2f321ffb-9063-11ee-8f5f-0d83eeffbb9c", "type": "subinterface" }, "setRoute": false, "type": "dhcprelayagent" } ], "agents[2]": [ { "enableIpv4Relay": true, "enableIpv6Relay": false, "interface": { "id": "b2bd3384-9063-11ee-8f5f-cb99fc234435", "type": "subinterface" }, "setRoute": false, "type": "dhcprelayagent" } ], "agents[3]": [ { "enableIpv4Relay": true, "enableIpv6Relay": false, "interface": { "id": "b96eea77-9063-11ee-8f5f-81d10b4858ef", "type": "subinterface" }, "setRoute": false, "type": "dhcprelayagent" } ], "agents[4]": [ { "enableIpv4Relay": true, "enableIpv6Relay": false, "interface": { "id": "c01297aa-9063-11ee-8f5f-b5272134f9bc", "type": "subinterface" }, "setRoute": false, "type": "dhcprelayagent" } ], "description": "NAME_DHCP-RELAY-SERVER", "id": "c25e5737-9be2-11ed-8442-7f729e5d90b5", "ipv4RelayTimeout": 60, "ipv6RelayTimeout": 60, "name": "NAME_DHCP-RELAY-SERVER", "servers[0]": [ { "interface": { "id": "5318e182-9065-11ee-8f5f-39e51efbc113", "type": "subinterface" }, "server": { "name": "IPv4_name", "type": "networkobject" }, "type": "dhcprelayserver" } ], "servers[1]": [ { "interface": { "id": "5318e182-9065-11ee-8f5f-39e51efbc113", "type": "subinterface" }, "server": { "name": "IPv4_name", "type": "networkobject" }, "type": "dhcprelayserver" } ], "type": "dhcprelayservice", "version": "oodxtfoeskckb" }, "filters": { "name": "NAME_DHCP-RELAY-SERVER" }, "operation": "upsertDHCPRelayService", "path_params": { "objId": "c25e5737-9be2-11ed-8442-7f729e5d90b5" }, "query_params": null, "register_as": null } }, "response": {} }

But the values for server and agent are not set. Do you have an idea?

Ansible-Output from getDHCPRelayService :

ok: [ftd-name] => { "ansible_facts": { "dhcprelay": { "id": "c25e5737-9be2-11ed-8442-7f729e5d90b5", "ipv4RelayTimeout": 60, "ipv6RelayTimeout": 60, "links": { "self": "https://X.X.X.X/api/fdm/v6/devicesettings/default/dhcprelayservices/c25e5737-9be2-11ed-8442-7f729e5d90b5" }, "name": "NAME_DHCP-RELAY-SERVER", "type": "dhcprelayservice", "version": "oodxtfoeskckb" } }, "changed": false, "invocation": { "module_args": { "data": null, "filters": null, "operation": "getDHCPRelayService", "path_params": { "objId": "c25e5737-9be2-11ed-8442-7f729e5d90b5" }, "query_params": null, "register_as": "dhcprelay" } }, "response": { "id": "c25e5737-9be2-11ed-8442-7f729e5d90b5", "ipv4RelayTimeout": 60, "ipv6RelayTimeout": 60, "links": { "self": "https://x.x.x.x/api/fdm/v6/devicesettings/default/dhcprelayservices/c25e5737-9be2-11ed-8442-7f729e5d90b5" }, "name": "NAME_DHCP-RELAY-SERVER", "type": "dhcprelayservice", "version": "oodxtfoeskckb" } }

Re: FTD - DHCPRelayService

MHM Cisco World — Fri, 15 Dec 2023 12:23:16 GMT

Why you use API?

This option available in FMC and I think in FDM (i will check ver. Support it).

MHM

Re: FTD - DHCPRelayService

kscholz — Fri, 15 Dec 2023 12:28:21 GMT

We have only FTD in Version "7.0.1-84" no FMC and no access to updates.
We use ansible for all Task at the Firewall (FTD).

Re: FTD - DHCPRelayService

Marcel Zehnder — Fri, 15 Dec 2023 12:32:27 GMT

I never worked with the FTD modules, as a workaround you can switch to the uri module and post the content in raw format/JSON (like in the API explorer): https://docs.ansible.com/ansible/latest/collections/ansible/builtin/uri_module.html

Re: FTD - DHCPRelayService

kscholz — Fri, 15 Dec 2023 12:36:21 GMT

Hi

Thank you, I'll try that.

Re: FTD - DHCPRelayService

kscholz — Sat, 16 Dec 2023 10:59:00 GMT

I found the solution myself.

Here for everyone who runs into the same error.

- Maintask:
- Notice:
- get_DHCPRelayService.yml | is needed to get version {every change create a new version.id}
- get_Subinterfaces.yml | all client interfaces and also the interface who running dhcpserver
- get_Networkobject_Hosts.yml | Networkobject-Host for all Dhcp-Servers
- create_upsertDHCPRelayService.yml | Puts everything together and create the DHCPRelayService

## dhcprelay - include_tasks: dhcprelay/get_DHCPRelayService.yml - include_tasks: dhcprelay/get_Subinterfaces.yml - include_tasks: dhcprelay/get_Networkobject_Hosts.yml - include_tasks: dhcprelay/create_upsertDHCPRelayService.yml

- get_DHCPRelayService.yml
(get objId from API-Explorer "devicesettings/default/dhcprelayservices")

- name: Execute getDHCPRelayService operation ftd_configuration: operation: getDHCPRelayService path_params: objId: "c25e5737-9be2-11ed-8442-7f729e5d90b5" register_as: dhcprelay

- get_subinterfaces.yml
(parentID = etherchannelinterfaces.id | objectId = subinterface.id | /devices/default/etherchannelinterfaces/{parentId}/subinterfaces/{objId} )

- name: Execute 'getEtherChannelSubInterface' operation for subinterface_dhcpserver ftd_configuration: operation: getEtherChannelSubInterface path_params: parentId: "3e566c4c-893f-11ee-affa-0f8b24bd1413" objId: "39f2769f-9062-11ee-8f5f-9fdadd220530" register_as: subinterface_running_dhcpserver - name: Execute 'getEtherChannelSubInterface' operation ftd_configuration: operation: getEtherChannelSubInterface path_params: parentId: "3e566c4c-893f-11ee-affa-0f8b24bd1413" objId: "4b2a27c7-9063-11ee-8f5f-e509fc162e52" register_as: subinterface_for_dhcp_client_x

- get_networkobject_hosts.yml
(objectId = dhcpserver.id | object/networks)

--- - name: Get network object DHCPSRV01 ftd_configuration: operation: getNetworkObject path_params: objId: "a7229958-69ba-11ee-ac26-77f58cb87786" register_as: networkobject_ipv4_dhcpsrv01 - name: Get network object DHCPSRV02 ftd_configuration: operation: getNetworkObject path_params: objId: "a7f7758b-69ba-11ee-ac26-0199d25e7228" register_as: networkobject_ipv4_dhcpsrv02

- create_upsertDHCPRelayService.yml

--- - name: Execute upsertDHCPRelayService operation ftd_configuration: operation: upsertDHCPRelayService data: version: "{{ dhcprelay.version }}" name: NAME_DHCP-RELAY-SERVER description: "NAME_DHCP-RELAY-SERVER" ipv4RelayTimeout: 60 ipv6RelayTimeout: 60 servers: [ {"interface": {"id": " {{ subinterface_running_dhcpserver.id }} ", "type": "subinterface"}, "server": {"id": " {{ networkobject_ipv4_dhcpsrv01.id }} ", "type": "networkobject"}, "type": "dhcprelayserver"}, {"interface": {"id": " {{ subinterface_running_dhcpserver.id }} ", "type": "subinterface"}, "server": {"id": " {{ networkobject_ipv4_dhcpsrv02.id }} ", "type": "networkobject"}, "type": "dhcprelayserver"} ] agents: [ {"enableIpv4Relay": true, "enableIpv6Relay": false, "interface": {"id": " {{ subinterface_for_dhcp_client_x.id }} ", "type": "subinterface"}, "setRoute": false, "type": "dhcprelayagent"}, {"enableIpv4Relay": true, "enableIpv6Relay": false, "interface": {"id": " {{ subinterface_for_dhcp_client_x.id }} ", "type": "subinterface"}, "setRoute": false, "type": "dhcprelayagent"} ] type: dhcprelayservice