topic Re: How to export All the rules from a 8350 FirePower Policy in Network Security

How to export All the rules from a 8350 FirePower Policy

subrun.jamil — Fri, 21 Feb 2020 17:11:09 GMT

Hello,

How to export All the rules in a FirePower Policy. Reason I am asking this question is searching items in SourceFire is not that much user friendly. Like If I want to search with a AD Group name it really does not look at User field. That's why just wondering how to search AD Group in a Firewall Policy. Also better to know after exporting a Firewall Policy How to view them ?

Re: How to export All the rules from a 8350 FirePower Policy

Francesco Molino — Sat, 01 Jun 2019 05:06:04 GMT

Hi

You will need to use API calls to export ACP and into returned results you'll see all role details which means you will have the AD group condition.

Re: How to export All the rules from a 8350 FirePower Policy

Marvin Rhoads — Sat, 01 Jun 2019 05:11:43 GMT

The deployed access control policy should be located in:

/var/sf/detection_engines/UUID/ngfw.rules

The UUID (Universally Unique Identifier) will vary - look in /var/sf/detection_engines folder for your UUIDs and, if there are multiple, choose the one with the latest timestamp.

You can export and/or search that file (e.g. with grep utility) to examine the ACP in more detail.

Re: How to export All the rules from a 8350 FirePower Policy

subrun.jamil — Tue, 02 Jul 2019 16:22:23 GMT

Hello Marvin,

How can I get rid of below message while trying to scp

root@HH-HHH-HH1:/var/sf/detection_engines/302e2fca-7a77-11e6-870d-af9f5b863148# sudo scp ngfw.rules admin@10.7.XX.XX:/var/tmp
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:4raWthjsdjfhsdjhfkjsdhfiwryeiuweryVgdqAQLwraTy3L0NJk.
Please contact your system administrator.
Add correct host key in /root/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /root/.ssh/known_hosts:2
ECDSA host key for 10.7.XX.XX has changed and you have requested strict checking.
Host key verification failed.
lost connection

Re: How to export All the rules from a 8350 FirePower Policy

Marvin Rhoads — Wed, 03 Jul 2019 01:10:31 GMT

Do like the message says and:

"Add correct host key in /root/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /root/.ssh/known_hosts:2"