topic Re: FMC-Copying Access rules from an ACP and applying those copied rules to another ACP in Network Security

FMC-Copying Access rules from an ACP and applying those copied rules to another ACP

Narayan Dev Sarma — Thu, 16 Apr 2020 18:50:03 GMT

Is there a way in FMC to copy access rules from an ACP and paste those in another ACP which is already loaded with access rules and applied to an FTD. Actually, will have to 2-3 migrations of ASAs to FTD but at different time frames. So, at last need to have all consolidated as one ACP. Tried inheritance policy option but can't modify the copied rules.

FMC-ver-6.4.04

Re: FMC-Copying Access rules from an ACP and applying those copied rules to another ACP

Francesco Molino — Fri, 17 Apr 2020 03:17:53 GMT

Hi,

There's no way to copy a rule from 1 ACP and paste over another ACP.
The only way would be to use APIs to do so.

Re: FMC-Copying Access rules from an ACP and applying those copied rules to another ACP

Marvin Rhoads — Fri, 17 Apr 2020 06:14:23 GMT

It's not supported - even in FMC 6.6.

If you use CDO management, it is quite easy to do. However CDO cannot (currently) manage a device that is also FMC-managed.

CDO uses the API to interact with managed devices along the lines @Francesco Molino was referring to.

Re: FMC-Copying Access rules from an ACP and applying those copied rules to another ACP

Narayan Dev Sarma — Fri, 17 Apr 2020 07:05:57 GMT

Thanks for your reply

Re: FMC-Copying Access rules from an ACP and applying those copied rules to another ACP

Narayan Dev Sarma — Fri, 17 Apr 2020 07:07:34 GMT

Thanks for your reply.

Does FMC offers an API to perform this?

Re: FMC-Copying Access rules from an ACP and applying those copied rules to another ACP

Francesco Molino — Sat, 18 Apr 2020 01:28:31 GMT

There's no 1 api to do copy/paste specifically but using api you can read at rules for 1 ACP and then re-create them into the other ACP.

Re: FMC-Copying Access rules from an ACP and applying those copied rules to another ACP

Narayan Dev Sarma — Sun, 19 Apr 2020 10:37:41 GMT

Thanks. I am still a new learner with APIs but will give a try.

Re: FMC-Copying Access rules from an ACP and applying those copied rules to another ACP

Anupam Pavithran — Tue, 22 Sep 2020 08:30:37 GMT

Hi Narayan,

We have created a python script for achieving the same. Please check if it's helpful in you case.

https://community.cisco.com/t5/security-documents/fmc-api-based-tool-merge-two-access-control-policy-s-rules-into/ta-p/4109405

Re: FMC-Copying Access rules from an ACP and applying those copied rules to another ACP

Peter Beshay — Tue, 11 May 2021 14:54:47 GMT

the New version 6.7.0 can do the copy from ACP to another ACP or from Prefilter Policy to another Prefilter Policy

"Copy and move rules between access control and prefilter policies"
https://www.cisco.com/c/en/us/td/docs/security/firepower/670/relnotes/firepower-release-notes-670/features.html