topic Re: Cisco FMC/FTD - Adding Bulk NAT or ACL in Network Security

Cisco FMC/FTD - Adding Bulk NAT or ACL

shabeeb — Sun, 28 Jun 2020 08:55:49 GMT

Team,

Is there anyway i can add a lot of new NAT or ACL rules in Bulk?

I have noticed that this is possible via the FMC API, but for a noob like me, the scripting, json, python etc doesnt make any sense. Is there a working example of how we can do this. Any help is appreciated.

Regards,

Shabeeb

Re: Cisco FMC/FTD - Adding Bulk NAT or ACL

Francesco Molino — Mon, 29 Jun 2020 04:15:49 GMT

Hi

You're right there only way would be using API.
I'm on my phone right now so can't give you a quick example but can you look at developer.cisco.com or GitHub if there are existing cider example doing so?
Otherwise I'll try to do something quick and dirty tomorrow or Tuesday if I got time.

Re: Cisco FMC/FTD - Adding Bulk NAT or ACL

shabeeb — Sun, 05 Jul 2020 16:40:28 GMT

Hi Francesco,

Kind reminder. Im going through the cisco developer api tools. Theres is a lot of new things for me. I feel this is going to take some time to properly understand.

In the meantime, anything you can provide will be a great help for me and pretty much everyone like me 😄

TIA,

Shabeeb

Re: Cisco FMC/FTD - Adding Bulk NAT or ACL

Francesco Molino — Sun, 05 Jul 2020 18:39:28 GMT

You can go on FMC api explorer (https://fmc/api/api-explorer/) and loop across some apis functions. I believe this will be more complex if you never played with Python.

I would recommend you use ansible as most functions are already built and you need to fill in variables.
Here a devnet ansible help: https://developer.cisco.com/docs/ftd-ansible-v6-3/#!examples/create-an-accessrule

I'm sorry I didn't had time to make a a quick and dirty playbook but the way you'll need to run it will be:
- Have a excel file with access rules and nat
- You need to validate objects your using in both of them are already created and get their id or create them and get their id
- Then you can create rules and nat policies.

If you go to the github related project, you will have examples on how to create all of these: https://github.com/CiscoDevNet/FTDAnsible/tree/master/samples/ftd_configuration
Examples are in folder samples/ftd_configuration

Hope this helps

Re: Cisco FMC/FTD - Adding Bulk NAT or ACL

shabeeb — Tue, 07 Jul 2020 20:52:47 GMT

Hi Francesco,

Appreciate this a lot. Ill need to spend the next few days trying out these. Fingers crossed.

BR,
Shabeeb

Re: Cisco FMC/FTD - Adding Bulk NAT or ACL

Francesco Molino — Thu, 09 Jul 2020 00:19:59 GMT

Sure if you need help to understand something or helping on issues while running them, let us know.

Re: Cisco FMC/FTD - Adding Bulk NAT or ACL

Supermantech — Wed, 30 Sep 2020 17:50:56 GMT

Hi Francesco

Can you give an example of

1. adding a new ACL

2. Removing an existing ACL

3. Adding an object (like ip address)

Thank you

rod

Re: Cisco FMC/FTD - Adding Bulk NAT or ACL

Francesco Molino — Mon, 05 Oct 2020 03:31:26 GMT

I don't have a playbook already built as I'm mostly using APIs with csv file.
Allow me some time to do that after my work and I'll come back to you

Re: Cisco FMC/FTD - Adding Bulk NAT or ACL

Francesco Molino — Thu, 15 Oct 2020 01:29:45 GMT

Didn't forget you. I'll try my best this weekend.

Re: Cisco FMC/FTD - Adding Bulk NAT or ACL

Francesco Molino — Sat, 17 Oct 2020 19:13:13 GMT

I was building you an example but while going to the github page I saw samples are already existing.

Check this out: https://github.com/CiscoDevNet/FTDAnsible/tree/master/samples