topic Re: Export NAT Rules from FMC (Manual or API) in Network Security

Export NAT Rules from FMC (Manual or API)

mrlorincz — Fri, 11 Nov 2022 21:24:35 GMT

Does anyone know of a way to export the NAT policies from FMC? Preferably with API but even a manual report would suffice. I've found some handy scripts on exporting ACP policies, but nothing on NAT.

Thanks!

Mike

Re: Export NAT Rules from FMC (Manual or API)

Rob Ingram — Fri, 11 Nov 2022 21:31:51 GMT

@mrlorincz you can export NAT policies/rules using API - https://www.cisco.com/c/en/us/td/docs/security/firepower/70/api/REST/firepower_management_center_rest_api_quick_start_guide_70/Objects_In_The_REST_API.html#reference_hfp_vtc_bcb

Re: Export NAT Rules from FMC (Manual or API)

mrlorincz — Sat, 12 Nov 2022 00:22:20 GMT

Thanks, this is helpful and I'm able to run some gets in postman, but i need to run a separate get for each object_uuid (rule) in the nat policy list, a bit tedious for my applications.

Anyone know of a script that gets the natrules and parses the various object_uuids, maybe into a csv or something? If I had any scripting skills of my own I'd take a crack but alas I'm not very knowledgeable there.

Re: Export NAT Rules from FMC (Manual or API)

jjevans1 — Wed, 15 Feb 2023 18:32:02 GMT

Has anyone come up with a reasonable work around on how to export all NAT Policies from FMC?

Re: Export NAT Rules from FMC (Manual or API)

mrlorincz — Thu, 16 Feb 2023 19:20:24 GMT

@jjevans

Nothing natively built in that I can find. For ACP rules, I ultimately I ended up getting familiar enough with python to be able to run this script, it worked great

https://github.com/raghukul-cisco/csvExportFirepower

For NAT rules, it's possible to use API, but I didn't find a pre-canned script. I utlimately just did a 'show nat' from the cli and manually pasted into excel file.

I might toy with creating NAT to CSV feature using the fireREST suite. https://github.com/kaisero/fireREST

I wouldn't be surprised if someone already created one, just need to scour the cisco dev exchange for it