topic Re: correct endpoint for firewall rules? in Network Platform API

correct endpoint for firewall rules?

Adrian41 — Mon, 30 Jan 2023 12:17:27 GMT

Hi,

New to API's and coding in general.

I am trying to write a script that adds a new firewall rule to a network (I'm using a test site atm).

However I am getting a 404 error which I assume means my URL is wrong?

I got this from the Meraki reference guide but I'm not sure its correct.

/networks/{network_id}/appliance/firewall/l3firewallRules

Also - I read somewhere that adding a new rule would overwrite all the existing rules! Is that true and if so is there a way to add a rule so that it doesn't effect any existing rules?

Thanks!

import requests
import security
import json


api_key = security.MERAKI_API_KEY
organizationId = security.ORG_ID
network_id = "xxxxxxxxx"

rule = {
    'name': 'Test Rule',
    'policy': 'deny',
    'protocol': 'any',
    'srcPort': 'any',
    'srcCidr': '1.1.1.1/24',
    'dstPort': 'any',
    'dstCidr': '0.0.0.0/0',
}


url = f"https://api.meraki.com/api/v1/networks/{network_id}/appliance/firewall/l3firewallRules"


headers = {
    'X-Cisco-Meraki-API-Key': api_key,
    'Content-Type': 'application/json'
}


response = requests.post(url, headers=headers, data=json.dumps(rule), verify=False)

print(response.status_code)

Re: correct endpoint for firewall rules?

aleabrahao — Mon, 30 Jan 2023 12:27:59 GMT

Here is the correct URL:

https://developer.cisco.com/meraki/api/#!update-network-l-3-firewall-rules

Re: correct endpoint for firewall rules?

Adrian41 — Mon, 30 Jan 2023 13:14:12 GMT

Hi,

Thanks for the reply, but Im still getting a 404 error 😞

am I getting the url wrong or can something else cause this issue?

url = f"https://api.meraki.com/api/v1/networks/{network_id}/l3FirewallRules"

response = requests.post(url, headers=headers, data=json.dumps(rule), verify=False)

Re: correct endpoint for firewall rules?

Adrian41 — Mon, 30 Jan 2023 13:19:42 GMT

I think your link may be the out of date version 0

Version 1

https://developer.cisco.com/meraki/api-v1/#!update-network-appliance-firewall-l-3-firewall-rules

Re: correct endpoint for firewall rules?

aleabrahao — Mon, 30 Jan 2023 13:21:14 GMT

404 - Not Found The requested resource doesn't exist or incorrect API key

You can test It on the Meraki developer Hub before.

Re: correct endpoint for firewall rules?

Raphael_L — Mon, 30 Jan 2023 13:21:15 GMT

I would troubleshoot this issue with these steps :

1- Create a dummy rule from the dashboard

2- GET the rule via the API

3- PUT the exact same response received from step #2.

You have to be Org admin / Net admin to do that.

Re: correct endpoint for firewall rules?

aleabrahao — Mon, 30 Jan 2023 13:22:38 GMT

Use this one:

https://developer.cisco.com/meraki/api-latest/

Re: correct endpoint for firewall rules?

Adrian41 — Mon, 30 Jan 2023 13:30:29 GMT

If I run the exact same script as a GET - it works ok. I can also run the get from the dashboard.

I noticed I was using POST rather than PUT so made that change but if I do that I get a 400 error instead 😞

url = f"https://api.meraki.com/api/v1/networks/{network_id}/appliance/firewall/l3FirewallRules"

response = requests.put(url, headers=headers, data=json.dumps(rule), verify=False)

Re: correct endpoint for firewall rules?

Adrian41 — Mon, 30 Jan 2023 13:33:30 GMT

huh - if I try to use the PUT operation from the dashboard - its gets a 404 there too

Re: correct endpoint for firewall rules?

aleabrahao — Mon, 30 Jan 2023 13:33:49 GMT

400 - Bad Request The request was unacceptable, often due to missing a required parameter.

Re: correct endpoint for firewall rules?

Adrian41 — Mon, 30 Jan 2023 13:35:59 GMT

shouldn't the dashboard tell me if there are any required parameters?

Re: correct endpoint for firewall rules?

aleabrahao — Mon, 30 Jan 2023 13:36:21 GMT

Have you enabled API access?

https://documentation.meraki.com/General_Administration/Other_Topics/Cisco_Meraki_Dashboard_API#:~:text=test%20API%20calls.-,Enable%20API%20Access,to%20generate%20an%20API%20key.

Re: correct endpoint for firewall rules?

Raphael_L — Mon, 30 Jan 2023 13:38:06 GMT

HTTP400 is sent because the dashboard doesn't like your request. Doesn't mean you are missing a parameter.

Using the Meraki SDK would be easier to troubleshoot.

The issue is within the payload.

data=json.dumps(rule)

Re: correct endpoint for firewall rules?

aleabrahao — Mon, 30 Jan 2023 13:39:55 GMT

https://developer.cisco.com/codeexchange/github/repo/CiscoSE/AddMerakiMXL3FirewallRuleToNetworks#usecase

https://developer.cisco.com/meraki/build/mx-firewall-control-python-script/

Re: correct endpoint for firewall rules?

Raphael_L — Mon, 30 Jan 2023 13:41:22 GMT

Not pretty , but should work.

import os
import json
import requests
import codecs

base_url_v1 = 'https://api.meraki.com/api/v1'
NetworkID = XXXXXXXXXXX
headers = {
	'x-cisco-meraki-api-key': format(str(apikey)),
	'Content-Type': 'application/json'
}
def __returnhandler(statuscode, returntext):
    if str(statuscode) == '200':
        return returntext
    else:
        print('HTTP Status Code: {0}\n'.format(statuscode))
def getL3FirewallRules():
    geturl = '{0}/networks/{1}/appliance/firewall/l3FirewallRules'.format(str(base_url_v1), str(NetworkID))
    dashboard = requests.get(geturl, headers=headers,verify=False)
    result = __returnhandler(dashboard.status_code, dashboard.text)
    return result 

L3FWRules = getL3FirewallRules()

payload = L3FWRules
url = 'https://api.meraki.com/api/v1/networks/{0}/appliance/firewall/l3FirewallRules'.format(NetworkID)
response = requests.request('PUT', url, headers=headers, data = payload,verify=False)
print(response.text.encode('utf8'))

Re: correct endpoint for firewall rules?

Adrian41 — Mon, 30 Jan 2023 13:43:46 GMT

Yes, as mentioned, moments before i tried the PUT I did a successful GET

Re: correct endpoint for firewall rules?

Adrian41 — Mon, 30 Jan 2023 13:51:03 GMT

Thanks you!

This put me on the right track. I changed

data=json.dumps(rule)

data=rule,

and then changed the rule paramater to this

rule = '''{
    "rules": [
        {
            "comment": "Test Rule.",
            "policy": "allow",
            "protocol": "tcp",
            "destPort": "443",
            "destCidr": "192.168.1.0/24",
            "srcPort": "Any",
            "srcCidr": "Any",
            "syslogEnabled": false
        }
    ]
}'''

(slight syntax change)

just my second issue now - this seems to overwrite all the existing rules rather than just add this to the list.

how do I add things without deleting all the others?

Re: correct endpoint for firewall rules?

aleabrahao — Mon, 30 Jan 2023 13:52:49 GMT

You can't update, you have to set all rules again when you create a new rule.

Re: correct endpoint for firewall rules?

Raphael_L — Mon, 30 Jan 2023 13:52:55 GMT

You can't append a rule. You have to push the whole rule base.

So I would suggest doing a GET first , append your modifications , then PUT the whole rule base.

Re: correct endpoint for firewall rules?

Adrian41 — Mon, 30 Jan 2023 13:53:58 GMT

am I going to have to call the existing rules, then add them along with the new rule to the update call and basically re-write all the rules each time?