Deleting/updating elements from NetworkDeviceGroupList using ISE ERS API

rockbear — Fri, 10 Jan 2020 10:38:08 GMT

Hi,

Some time ago, I needed to add a number of devices to ISE and decided to do it by using the API. While figuring out how to do that, I set up a dummy location and some dummy devices to play around with.

However, I screwed up and prepended a dummy location with "Locations#All Locations" instead of the proper "Location#All Locations". And then I must have set this to be a default parameter, so a bunch of live devices ended up in it.

Now I can't figure out how to remove it from these devices.

Example:

{
    "NetworkDevice": {
        "id": "bb96eb00-93e3-11e9-8806-005056aa563a",
        "name": "119.1UX2.1",
        "description": "Script-generated by pjuul on 2019-06-21 07:16:32.087453",
[..]
        "NetworkDeviceGroupList": [
            "Device Type#All Device Types#HP#HP_2810",
            "Location#All Locations#SAMF_LAN",
            "IPSEC#Is IPSEC Device",
            "Locations#All Locations#SAMF_LAN#MIDDLE_EARTH"
        ]
    }
}

I've tried PUT'ing an update in which the NetworkDeviceGroupList was reduced like this:

        "NetworkDeviceGroupList": [
            "Device Type#All Device Types#HP#HP_2810",
            "Location#All Locations#SAMF_LAN",
            "IPSEC#Is IPSEC Device"        
        ]

But that didn't work.

Any suggestions? I guess the tough way is to delete and rebuild the devices, but I'd prefer a softer touch.

Re: Deleting/updating elements from NetworkDeviceGroupList using ISE ERS API

hslai — Sat, 18 Jan 2020 17:38:56 GMT

[2020-01-18] CSCvs72758 filed to track this.

I got a similar result like below in the response for my update request.

{
   "UpdatedFieldsList":{
      "updatedField":[
         {
            "field":"NetworkDeviceGroupList",
            "oldValue":"item removed: Name:Locations#All Locations#SAMF_LAN2 ,Type:Locations, NSF REF: ABC"
         },
         {
            "field":"NetworkDeviceGroupList",
            "newValue":"item added: Name:Locations#All Locations ,Type:Locations, NSF REF: XYZ"
         }
      ]
   }
}

It's moving the NDG attribute to the root one. I am able to delete the child NDG one-by-one from the leave level but not the root NDG. Then, I have to either use the ISE admin UI on each NAD to "Set to Default" for the particular NDG or export the devices to a CSV, remove the extra NDG in the CSV, and then re-import it with the option to overwrite.

It seems to me either a bug or an enhancement for that particular ERS API.

topic Deleting/updating elements from NetworkDeviceGroupList using ISE ERS API in Network Access Control

Deleting/updating elements from NetworkDeviceGroupList using ISE ERS API

Re: Deleting/updating elements from NetworkDeviceGroupList using ISE ERS API