topic Re: Postman API calls to Cisco Secure Firewall not retrieving all obje in Network Security

Postman API calls to Cisco Secure Firewall not retrieving all objects

jaismith — Tue, 10 Dec 2024 15:59:29 GMT

Cisco Secure Firewall Version 7.4.2.1 (build 30)

I am trying to get all of our network objects using the following API call

{{protocol}}://{{hostname}}/api/fmc_config/v1/domain/{{domain_id}}/object/networks?expanded=true&limit=100

"paging": {

"offset": 0,

"limit": 100,

"count": 70,

"pages": 1

We have 25 pages and nearly 500 objects, but when I try to run this it only shows 70 objects and will not allow me to offset any higher than 69. It appears there is some limitation preventing me from pulling the remaining objects. Is anyone able to assist with getting all objects pulled from Secure Firewall? Please let me know if you need any more information

Secure Firewall, REST API, Cisco Firepower Management Center (FMC), API

Re: Postman API calls to Cisco Secure Firewall not retrieving all obje

bigevilbeard — Tue, 10 Dec 2024 16:22:04 GMT

According to the document for 7.x "The REST API will serve only 25 results per page. This can be increased up to 1000 using the limit query parameter" There was an old thread on this here https://community.cisco.com/t5/network-security/fmc-api-maximum-objects-1000/td-p/3758869

See what happens if you start with offset=0 and then offset=100, offset=200, and so on, until you have fetched all pages.

Re: Postman API calls to Cisco Secure Firewall not retrieving all obje

jaismith — Tue, 10 Dec 2024 16:27:02 GMT

Thank you for the reply. When increasing the offset at 70 or higher it returns a 0 count

"links": {},

"paging": {

"offset": 0,

"limit": 0,

"count": 0,

"pages": 0

}

Here is offset set to 69

"paging": {

"offset": 69,

"limit": 1000,

"count": 70,

"prev": [

"pages": 1

}

Re: Postman API calls to Cisco Secure Firewall not retrieving all obje

bigevilbeard — Tue, 10 Dec 2024 17:24:08 GMT

Interesting i wonder if this might be an issue with how the API handles offsets beyond the total number of objects? If i was doing this Python I would print out the count and length in each iteration and verify the exact number of objects given. Not sure how you do this in Postman tbh.

Are you seeing consistent behavior across different API calls too or just this one?

Re: Postman API calls to Cisco Secure Firewall not retrieving all obje

jaismith — Wed, 11 Dec 2024 13:47:37 GMT

I tested with port objects and it appears to pull all of them. Oddly, it appears to only limit the network objects. The "count" is displayed at the bottom when I send a GET request through postman.

Re: Postman API calls to Cisco Secure Firewall not retrieving all obje

bigevilbeard — Wed, 11 Dec 2024 14:10:03 GMT

@jaismith nice inconsistent pagination between different object types then, this suggests there might be a potential API bug specific to network object, maybe some hidden configuration limiting network object retrieval or even some unexpected constraint in the network object endpoint.

Ive not found anything else, other than past bugs which said results between what the UI showed and API differed.I did find this code which implies it works (does not say the version tho) https://github.com/CiscoDevNet/fmc-rest-api/blob/master/labs/firepower-restapi-106/3.md

Glancing over this - it shows the pagination Strategy as:

Loops 11 times
Retrieves 1000 objects per iteration
Uses offset calculation: i * 1000
Attempts to retrieve all network objects

Re: Postman API calls to Cisco Secure Firewall not retrieving all obje

jaismith — Wed, 11 Dec 2024 14:53:58 GMT

Getting in touch with my security team to allow this LOL.

Re: Postman API calls to Cisco Secure Firewall not retrieving all obje

gerard0796 — Wed, 11 Dec 2024 15:01:42 GMT

verry good.

Re: Postman API calls to Cisco Secure Firewall not retrieving all obje

jaismith — Wed, 11 Dec 2024 17:41:00 GMT

Firstly, thank you for your suggestion. I was able to get my access and when running the script, I am receiving the same results, making me think this issue isn't with the API call itself. Do you happen to have any other ideas?

Re: Postman API calls to Cisco Secure Firewall not retrieving all obje

bigevilbeard — Wed, 11 Dec 2024 17:55:47 GMT

Sorry @jaismith I maybe missing your ask. You are now using the Python script and it’s give you the same results as Postman was/is?

Re: Postman API calls to Cisco Secure Firewall not retrieving all obje

jaismith — Wed, 11 Dec 2024 20:01:39 GMT

It only appears to get only 70 objects, when nearly 500 exist in Secure Firewall.

Re: Postman API calls to Cisco Secure Firewall not retrieving all obje

bigevilbeard — Wed, 11 Dec 2024 20:12:09 GMT

@jaismith ok, so I think then there is an issue with the api endpoint here

Re: Postman API calls to Cisco Secure Firewall not retrieving all obje

jaismith — Wed, 11 Dec 2024 20:14:21 GMT

Thanks, I will move forward with a TAC case.