topic Re: Issue with Ansible for FTD - Invalid Data Provided 'Type' in Network Security

Issue with Ansible for FTD - Invalid Data Provided 'Type'

an.balsby — Thu, 14 Sep 2023 21:54:59 GMT

Hello Cisco Community,

I hope this post finds you well. I'm encountering an issue while using Ansible to manage my Cisco Firepower Threat Defense (FTD) firewall. Specifically, I'm trying to create a network object, but I keep running into the error message "Invalid data provided 'type'". I've tried troubleshooting this problem extensively and reviewed the post at https://community.cisco.com/t5/network-security/ftd-ansible-module/td-p/4158369, but it didn't provide a solution.

Here are the specifics of my environment:

Operating System: Ubuntu 22.04
Ansible Version: 8.4.0
Firepower Version: 7.3

I've followed the documentation and examples provided by Cisco and Ansible, but I can't seem to get past this error. My playbook snippet looks something like this:

- name: Create Network Object community.network.ftd_configuration: operation: "addNetworkObject" data: name: "my-object" description: "some object descr." subtype: "HOST" value: "192.168.1.1" type: "networkobject" register_as: result

I've also looked into the Ansible GitHub repository for the cisco.ftd module, and it does indeed seem abandonded. This could be a contributing factor to the issue, but I'm hopeful that there might be a workaround or a solution that others in the community have discovered.

Has anyone encountered a similar problem with Ansible and FTD? If so, could you please share your insights or any possible workarounds? Any help or guidance would be greatly appreciated.

Thank you in advance for your assistance!

Re: Issue with Ansible for FTD - Invalid Data Provided 'Type'

Marius Gunnerud — Sat, 30 Sep 2023 08:29:04 GMT

The fields look to be outdated. The fields you need are:

For Host

{
"name": "OBJECT NAME",
"description": "SOME DESCRIPTION",
"value": "192.168.1.1",
"type": "Host"
}

For Network

{
"name": "NETWORK NAME",
"description": "SOME DESCRIPTOIN",
"value": "192.168.1.0/24",
"type": "Network"
}

Re: Issue with Ansible for FTD - Invalid Data Provided 'Type'

an.balsby — Sat, 30 Sep 2023 11:23:11 GMT

Hi Marius
I tried your suggestion, but it is still the same.

Re: Issue with Ansible for FTD - Invalid Data Provided 'Type'

Marius Gunnerud — Sat, 30 Sep 2023 14:49:12 GMT

Is this an FTD managed by FMC or FDM?

Re: Issue with Ansible for FTD - Invalid Data Provided 'Type'

an.balsby — Sun, 01 Oct 2023 13:24:05 GMT

This is managed by FDM.

Re: Issue with Ansible for FTD - Invalid Data Provided 'Type'

urathod — Wed, 11 Oct 2023 04:32:54 GMT

The error message suggests that the value you're providing for the 'type' parameter is not valid. According to the Ansible documentation for the ftd_configuration module, the valid values for the 'type' parameter are 'host', 'network', 'range', 'fqdn', 'country', 'port', 'protocol', 'url', 'wildcard', 'mac', 'user', 'usergroup', 'realm', 'securityzone', 'geolocation', 'attribute', and 'atp'.

In your playbook snippet, you've set the 'type' parameter to 'networkobject', which is not a valid value. You should change it to one of the valid types mentioned above.

Here's an updated version of your playbook snippet:

- name: Create Network Object
  community.network.ftd_configuration:
    operation: "addNetworkObject"
    data:
      name: "my-object"
      description: "some object descr."
      subtype: "HOST"
      value: "192.168.1.1"
      type: "host"
  register_as: result

Please make sure to adjust the 'type' parameter to one of the valid values mentioned earlier. This should resolve the "Invalid data provided 'type'" error.

If you find my reply solved your question or issue, kindly click the 'Accept as Solution' button and vote it as helpful.

You can also learn more about Secure Firewall (formerly known as NGFW) through our live Ask the Experts (ATXs) session. Check out Cisco Network Security ATXs Resources [https://community.cisco.com/t5/security-knowledge-base/cisco-network-security-ask-the-experts-resources/ta-p/4416493] to view the latest schedule for upcoming sessions, as well as the useful references, e.g. online guides, FAQs.

Re: Issue with Ansible for FTD - Invalid Data Provided 'Type'

an.balsby — Wed, 11 Oct 2023 19:41:59 GMT

Hi Urathod

Thank you for trying to help.

I Just tried to run your sample, but it does exactly the same. I attached a screenshot.

I even tried running the exmple from the devnet, but that does the same: https://developer.cisco.com/docs/ftd-ansible-api-v7-2/#!ftd_configuration/examples.

I looked at the Ansible doc here: https://docs.ansible.com/ansible/latest/collections/community/network/ftd_configuration_module.html#ansible-collections-community-network-ftd-configuration-module

To me it looks like my initial playbook was correct. I am just not sure what is going on here...

Did you have your suggestion working?

Re: Issue with Ansible for FTD - Invalid Data Provided 'Type'

AdamOrdal — Wed, 14 Feb 2024 22:48:27 GMT

Hey there, were you able to solve this problem? I ran into the same issue and it looks like the FTDAnsible included with even the latest version of Ansible is outdated and doesn't provide support for the type field. I was able to resolve this by replacing the fdm_swagger_client.py in my python distro with the newer version from https://github.com/CiscoDevNet/FTDAnsible/blob/master/module_utils/fdm_swagger_client.py. This may work for you by just doing that it did on one of my machines. On another of my machines with a newer version of Ansible I had to modify that file with the newer import on line 19. Essentially replacing the line with

from ansible_collections.community.network.plugins.module_utils.network.ftd.common import HTTPMethod

. Hope that helps!

Re: Issue with Ansible for FTD - Invalid Data Provided 'Type'

an.balsby — Wed, 21 Feb 2024 07:49:55 GMT

Hi AdamOrdal

No i never got the Ansible scripts to work. I ended up stitching some Python together instead. It was a hassle to me, since i'm not a programmer, but i made it work.

I did find the suggestion you mention here, but never got it to work. If you just made it work, i will try it again, because i really rather want to use Ansible.

Thank you for the suggestion 🙂

Re: Issue with Ansible for FTD - Invalid Data Provided 'Type'

mtejerob — Wed, 21 Feb 2024 10:20:44 GMT

I'm literally having the same error, I don't understand what's happening and I can't find a solution anywhere...

Re: Issue with Ansible for FTD - Invalid Data Provided 'Type'

mtejerob — Wed, 21 Feb 2024 10:47:58 GMT

Hello, I have solved the error in the following way:
https://github.com/CiscoDevNet/FTDAnsible/blob/master/module_utils/fdm_swagger_client.py

You have to replace this file with this code and within this code you also have to replace the following line:
from ansible.module_utils.network.ftd.common import HTTPMethod
By this line:
from ansible_collections.community.network.plugins.module_utils.network.ftd.common import HTTPMethod
With these two changes it already works, I hope it works for you, if you have questions you can write to me without problem

Re: Issue with Ansible for FTD - Invalid Data Provided 'Type'

an.balsby — Wed, 21 Feb 2024 11:32:25 GMT

I have a feeling that the repos (or at least this code for FTD), has been abandoned. I tried reaching out via a bug report on GitHub, but no one ever responded.

But if the solution here works, then atleast. that will work until next time Cisco changes the API.

Re: Issue with Ansible for FTD - Invalid Data Provided 'Type'

dankang — Wed, 27 Mar 2024 03:53:02 GMT

This seems to happen due to the failure during data validation.
When you make 'add' or 'upsert' operation which works with 'PUT' or 'POST' api call, python module checks if the user input aligns with what FTD expected to see.( def validate_data in FTDAnsible / module_utils/fdm_swagger_client.py )
And to find what 'FTD expected to see' it makes an API call to "/apispec/ngfw.json".

For an example of 'networkobject', it will try to find 'networkobject' from ngfw.json file and see what is expected value and compare it with what you provided in the Ansible playbook.

The issue here is, in the ngfw.json file, I'm seeing unexpected value returned for some of attributes. Below is a snippet of ngfw.json where it relates to networkobject.

"NetworkObject": { "type": "object", "properties": { "version": { "type": "string" }, "name": { "type": "string" }, "description": { "type": "string" }, "subType": { "$ref": "#/definitions/NetworkObjectType" }, "value": { "type": "string" }, "isSystemDefined": { "type": "boolean" }, "dnsResolution": { "$ref": "#/definitions/FQDNDNSResolution" }, "id": { "type": "string" }, "type": { "type": "string", "default": "networkobject" } }, "required": [ "name", "subType", "type", "value" ] },

From this result, we can see version, name and description value's type needs to be string, however we are seeing '$ref' instead of 'type' under subType, also '#/definitions/NetworkObjectType' instead of 'string'. This will cause an exception during data valiadation process.

I wouldn't call this as Ansible module issue, but more of FTD providing unexpected value on /apispec/ngfw.json api call.
I haven't tested on various versions so, the outcome might be different based on the version.