topic Re: Modify FMC Objects via API in Network Security

Modify FMC Objects via API

Scott_22 — Tue, 02 Feb 2021 15:59:18 GMT

I've been reviewing documentation for the FMC API and have not come across a script to update an existing object. Is there a way to perform this function as of FMC version 6.6.1? I have successfully created objects, but I require further information to update one.

Re: Modify FMC Objects via API

Marius Gunnerud — Tue, 02 Feb 2021 21:42:16 GMT

you need to use PUT to update objects. So you would need to find the ID of the object you intend to update or you could just find the URL located in "links": {"self": "https://......."}

for example, the following is a group that I created in my lab. I could get the "links"["self"] output and use that when sending a PUT.

    {
      "links": {
        "self": "https://1.1.1.1/api/fmc_config/v1/domain/e276abec-e0f2-11e3-8169-6d9ed49b625f/object/hosts/000C29C8-1550-0ed3-0000-017179869705",
        "parent": "https://1.1.1.1/api/fmc_config/v1/domain/e276abec-e0f2-11e3-8169-6d9ed49b625f/object/networkaddresses"
      },
      "type": "Host",
      "value": "192.168.0.100",
      "overridable": false,
      "description": " ",
      "id": "000C29C8-1550-0ed3-0000-017179869705",
      "name": "object1",
      "metadata": {
        "timestamp": 1610444763286,
        "lastUser": {
          "name": "marius"
        },
        "domain": {
          "name": "Global",
          "id": "e276abec-e0f2-11e3-8169-6d9ed49b625f",
          "type": "Domain"
        },
        "ipType": "V_4",
        "parentType": "NetworkAddress"
      }

Re: Modify FMC Objects via API

Scott_22 — Wed, 03 Feb 2021 15:54:21 GMT

Finding the ID for every object seems....burdensome. If I need to batch update objects, is this the only way to do it without going one by one in the GUI?

Re: Modify FMC Objects via API

Marius Gunnerud — Wed, 03 Feb 2021 19:31:25 GMT

I was not thinking of doing it one by one in GUI. I was leaning more towards scripting using python or similar.

You could try the api-explorer GET the objects you require, change the values and then send the updates with a PUT

Re: Modify FMC Objects via API

Scott_22 — Wed, 03 Feb 2021 21:21:57 GMT

Can you provide documentation on the GET procedure to pull the objects and PUT?

Re: Modify FMC Objects via API

Marius Gunnerud — Wed, 03 Feb 2021 21:34:33 GMT

The api-explorer can be found on your FMC. just go to https://<ip of fmc>/api/api-explorer. All available GET, PUT, POST and DELETE can be found here an you can try them out/use them individually.

You can also go to DevNet for free courses on APIs: https://developer.cisco.com/startnow/

Re: Modify FMC Objects via API

Oliver Kaiser — Wed, 03 Feb 2021 21:54:36 GMT

Using an existing library would probably be the best idea, that way you do not have to worry about paging, etc.

Example in Python using FireREST (https://github.com/kaisero/fireREST). See README for installation instructions

# import FMC object from FireREST library from fireREST import FMC # initialize API object (authenticated with FMC) fmc = FMC(hostname='fmc.example.com', username='api', password='Cisco123', domain='Global') # get all network obejcts from Global domain networks = fmc.object.network.get() # iterate through all network obejcts and change description for network in networks: network['description'] = 'Changed smth via API' fmc.object.network.update(data=network)

Hope that helps 🙂

Re: Modify FMC Objects via API

Scott_22 — Tue, 30 Mar 2021 18:44:13 GMT

Once the objects are pulled using FireREST, is there a mechanism to go through and update the name of the objects, then push the updated list to the FMC? This way I don't have duplicates.