topic Re: how to Bulk Request security group in Network Access Control

how to Bulk Request security group

Kevin Kai Zhang — Thu, 06 Aug 2020 10:12:48 GMT

Hello,

I am trying to create a bulk request to submit the security groups, do you know how to build it in json? i am in trouble to build the request_body in json. i create one and send a put request and get some errors.

here is the request_body i build,

{
"sgtBulkrequest": {
"operationType": "create",
"resourcesList": {
"Sgt": [
{
"name": "sgt1",
"description": "description",
"value": 101,
"propogateToApic": true
},
{
"name": "sgt2",
"description": "description",
"value": 102,
"propogateToApic": true
}
]
}
}
}

and i got status.code 400 with below error,

<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<ns3:ersResponse operation="PUT-executeBulk-sgt" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:ns3="ers.ise.cisco.com">
<link rel="related" href="https://192.168.132.200:9060/ers/config/sgt/bulk/submit" type="application/xml"/>
<messages>
<message type="ERROR" code="Schema validation exception">
<title>XML Schema Validation Failed :: at line 1, column 1 : Content is not allowed in prolog.</title>
</message>
</messages>
</ns3:ersResponse>

Re: how to Bulk Request security group

thomas — Fri, 07 Aug 2020 22:26:40 GMT

I was not able to get the bulk operation to work with JSON data. I have asked Engineering for confirmation about JSON support with BULK requests. I was able to do it with XML data as shown below.

sgts.xml file contents:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<ns5:sgtBulkrequest operationType="create" resourceMediaType="vnd.com.cisco.ise.trustsec.sgt.1.0+xml" xmlns:ns6="sxp.ers.ise.cisco.com" xmlns:ns5="trustsec.ers.ise.cisco.com" xmlns:ns8="network.ers.ise.cisco.com" xmlns:ns7="anc.ers.ise.cisco.com" xmlns:ers="ers.ise.cisco.com" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:ns4="identity.ers.ise.cisco.com">
<ns5:resourcesList>
<ns5:sgt description="bulk demo sgt" name="91">
<generationId>0</generationId>
<value>91</value>
</ns5:sgt>
<ns5:sgt description="bulk demo sgt" name="92">
<generationId>0</generationId>
<value>92</value>
</ns5:sgt>
<ns5:sgt description="bulk demo sgt" name="93">
<generationId>0</generationId>
<value>93</value>
</ns5:sgt>
<ns5:sgt description="bulk demo sgt" name="94">
<generationId>0</generationId>
<value>94</value>
</ns5:sgt>
<ns5:sgt description="bulk demo sgt" name="95">
<generationId>0</generationId>
<value>95</value>
</ns5:sgt>
</ns5:resourcesList>
</ns5:sgtBulkrequest>

Then submit the sgts.xml data file (note the @ character prefixing the sgts.xml file!) using a PUT request for the SGT bulk update. Note that it accepted XML even though I explicitly said the Content-Type is JSON:

curl -k -s \
    --include \
    --header 'Content-Type:application/json' \
    --header 'Accept: application/json' \
    --user $ISE_REST_USERNAME:$ISE_REST_PASSWORD \
    --request PUT https://$ISE_PAN:9060/ers/config/sgt/bulk/submit  \
    --data @sgts.xml

And the successful 202 response with the Location ID for the bulk status:

HTTP/1.1 100
HTTP/1.1 202
Cache-Control: no-cache, no-store, must-revalidate
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: JSESSIONIDSSO=D4F0D0C4248A8D3382D5896B52A62099; Path=/; Secure; HttpOnly
Set-Cookie: APPSESSIONID=249DFB55ED8622B4E7870DD54707C66D; Path=/ers; Secure; HttpOnly
Pragma: no-cache
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;
X-XSS-Protection: 1; mode=block
Location: https://198.18.133.27:9060/ers/config/sgt/bulk/submit/1596838257981
Date: Fri, 07 Aug 2020 22:10:57 GMT
Content-Type: application/json;charset=utf-8
Content-Length: 0
Server:

Re: how to Bulk Request security group

Kevin Kai Zhang — Mon, 10 Aug 2020 00:57:47 GMT

thanks, thomas. it works for me when it's in .xml.

Re: how to Bulk Request security group

thomas — Mon, 10 Aug 2020 16:03:03 GMT

I confirmed with Engineering that that JSON is NOT currently supported with BULK requests.

This is also confirmed in another community post: ISE Bulk Operations REST API Seems to Only Supports XML