topic Re: Python script to DELETE objects from FMC using a CSV file in Network Security

Python script to DELETE objects from FMC using a CSV file

Maneck_UK — Thu, 04 Jun 2020 10:06:29 GMT

I have a fully working python script that can POST objects to the FMC API using a .csv file for the data.

FMC is 6.5.

I want to use this same approach/method to DELETE objects, but after many hours I have been unable to get the script to work.

Due to the errors I receive, I have to assume that there is something wrong in how my python script builds the URL, as the URL I intend to use, works when tested from POSTMAN.

I have looked extensively for sample deletion scripts, but the ones I can find all approach the deletion by deleting "all unused". As I am building a 10K object environment and I do not yet have any ACP, all my objects are currently unused.

Can anyone point out what the issue is please?

Error Messages

I get:

Status code: 400
Message: {"error":{"category":"FRAMEWORK","messages":[{"description":"Wrong URL for delete request."}],"severity":"ERROR"}}

This is why I believe the issue is an incorrect URL.

The object ID can be seen in my log entry as correct and picked up from the csv file:

Deleting object: 005056A6-6972-0ed3-0000-090194314100

The "Deleting object:" words come from my script

The object ID has been taken from the .csv file

(The objects in the .csv are compiled from a separate script operation and the .csv file is confirmed as correct (it has exactly the same format as the script used to POST objects and has been checked for erroneous spaces etc)).

This is the URL I am trying to form:

https://~~<FMCNAME>~~/api/fmc_config/v1/domain/e276abec-e0f2-11e3-8169-6d9ed49b625f/object/hosts/005056A6-6972-0ed3-0000-090194314010

This URL works perfectly from POSTMAN and the host get deleted.

Working Script

This is how the working POST objects from csv script builds the URL:

api_path = "/api/fmc_config/v1/domain/" + auth_domain + "/object/hosts"
url = server + api_path
if (url[-1] == '/'):
url = url[:-1]

for object in objects:
post_data = {
"name": object["name"],
"type": object["type"],
"value": object["value"],
"description": object["description"],
}
print('\n*********************************')
print('Creating object: ' + object["name"])

try:
r = requests.post(url, data=json.dumps(post_data), headers=headers, verify=False)
status_code = r.status_code
resp = r.text
log = open('post_objects.log', 'a')
print(" Status code: "+str(status_code))
json_resp = json.loads(resp)
log.write('\n----------------------------------------------------\n')
log.write(json.dumps(json_resp,sort_keys=True,indent=4, separators=(',', ': ')))

The csv is formatted as:

name,value,type,description
test-name1,10.1.1.1,host,host1
test-name2,10.1.1.2,host,host2

The only difference I can see in the URL between the POST and DELETE operations is a single "/" at the end of the path.

API explorer paths:

Object POST path

POST/api/fmc_config/v1/domain/{domainUUID}/object/hosts

Object DELETE path

DELETE/api/fmc_config/v1/domain/{domainUUID}/object/hosts/{objectId}

Failing Script

This is how the DELETE objects from csv script builds the URL:

api_path = "/api/fmc_config/v1/domain/" + auth_domain + "/object/hosts/"
url = server + api_path
if (url[-1] == '/'):
url = url[:-1]

for object in objects:
del_data = {
"objectid": object["objectid"]
}
print('\n***********************************')
print('Deleting object: ' + object["objectid"])

try:
r = requests.delete(url, data=json.dumps(del_data), headers=headers, verify=False)
status_code = r.status_code
resp = r.text
log = open('delete_objects.log', 'a')
print(" Status code: "+str(status_code))
json_resp = json.loads(resp)
log.write('\n----------------------------------------------------\n')
log.write(json.dumps(json_resp,sort_keys=True,indent=4, separators=(',', ': ')))

The csv is formatted as:

name,value,objectid
test-name1,10.1.1.1,005056A6-6972-0ed3-0000-090194314010
test-name2,10.1.1.2,005056A6-6972-0ed3-0000-090194313992

The failing script collects the name, user id and password and then runs through the entire csv file. Each deletion attempt collects the correct item from the csv and then fails with the same URL error message. The script then completes as expected.

Thanks in advance for your assistance.

Re: Python script to DELETE objects from FMC using a CSV file

Francesco Molino — Fri, 05 Jun 2020 04:19:24 GMT

Hi

You’re putting the objectid in the body but it should normally be in the url itself:

curl -X DELETE "https://fmc-fqdn/api/fmc_config/v1/domain/11111-1111-1111-1111-abcdef/object/hosts/005056A6-6972-0ed3-0000-090194314010" -H "accept: application/json" -H "X-auth-access-token: aaaaaa-aaaaaaa-aaaaa"

Re: Python script to DELETE objects from FMC using a CSV file

Maneck_UK — Fri, 05 Jun 2020 08:25:38 GMT

@Francesco Molino Thank you!

That makes sense.

I will look to see how to add the csv object routine to the url component of the script.

If anyone has any pointers they would be very much appreciated.

Re: Python script to DELETE objects from FMC using a CSV file

Maneck_UK — Sun, 07 Jun 2020 10:41:42 GMT

I've spent a lot more time trying to get this to work and continue to fail.

I can get a single object to delete if I add the url object ID data to the script for a single object.

like this: del_data = ['005056A6-6972-0ed3-0000-090194313992']

But this defeats the purpose of the script.

I believe I now have a correct url built from the csv file but I continue to get 404 incorrect url errors:

I'd very much appreciate any pointers as to where I'm going wrong with my python script, as you may be able to tell I'm new to this python scripting business.

Error message when using new CSV script

Error in connection --> 404 Client Error: Not Found for url: https://~~<FMC-NAME>~~/api/fmc_config/v1/domain/e276abec-e0f2-11e3-8169-6d9ed49b625f/object/hosts/005056A6-6972-0ed3-0000-090194314504

URL build script component

f = open("delid.csv")
objectsfile = csv.DictReader(f)

for object in objectsfile:
del_data = {
object["objectid"]
}

for object in del_data:
del_url = server + api_path + object

try:
r = requests.delete(del_url, headers=headers, verify=False)
status_code = r.status_code
resp = r.text
log = open('delete_objects.log', 'a')
print(" Status Code: "+str(status_code))
json_resp = json.loads(resp)
log.write(json.dumps(json_resp,sort_keys=True,indent=4, separators=(',', ': ')))

if status_code == 201 or status_code == 202:
print(" SUCCESS ")
elif status_code == 400:
print((" Message: ")+ resp + ('\n'))
else:
r.raise_for_status()
print((" Message: ")+ resp + ('\n'))

except requests.exceptions.HTTPError as err:
print("Connection Error --> "+str(err))
finally:
if r: r.close()

Re: Python script to DELETE objects from FMC using a CSV file

Francesco Molino — Sun, 07 Jun 2020 16:19:34 GMT

Here a quick and dirty python code that runs well.

Sometimes objects aren't deleted because attached to a policy or whatever, so have you checked the response of your response.text?

objectsdel = ['005056AD-AB1C-0ed3-0000-008589972365', '005056AD-AB1C-0ed3-0000-004294967567', '005056AD-AB1C-0ed3-0000-008589972347', '005056AD-AB1C-0ed3-0000-004294967636']

url1 = "https://10.10.10.10/api/fmc_config/v1/domain/e276abec-e0f2-11e3-8169-6d9ed49b625f/object/hosts/"

headers2 = {
  'Accept': 'application/json',
  'Content-Type': 'application/json',
}

headers2['X-auth-access-token'] = response.headers['X-auth-access-token']
headers2['X-auth-refresh-token'] = response.headers['X-auth-refresh-token']

for i in objectsdel:
  del_url = url1 + i
  r = requests.request("DELETE", del_url, headers=headers2, verify=False)
  status_code = r.status_code
  resp = r.text
  print(f" Status Code: {status_code}")
  print(f" text: {resp}")
  json_resp = json.loads(resp)

What version of FMC are you running?

Re: Python script to DELETE objects from FMC using a CSV file

Maneck_UK — Sun, 07 Jun 2020 19:09:50 GMT

@JonasKs Many thanks for helping me with the solution. I doubt I would have finished with your help.

Hotfix from Cisco Devnet provided the how to for my script.

I got it working with his helpers which disappointingly vanished as they provided excellent scripting info.

Hotfix then added additional polish to my script which actually worked without the suggested changes.

Please find the both my final script and the polished one from hotfix.