Cisco FMC- set up using script

[loc.nguyen]

Hi,

I need to create about hundred of objects and rules.  Using GUI is surely painful process.

I looks like REST API can do the job better, but it is quite complex I think.

Could you suggest any other way to do that? Or if REST API is the only way does, could you share links that I can learn form some good examples.

Thanks

Loc

[Georg Pauwen]

Hello,

REST API is a good option. Not sure if you have already seen the guide linked below:

https://www.cisco.com/c/en/us/td/docs/security/firepower/620/api/REST/Firepower_Management_Center_REST_API_Quick_Start_Guide_620/Objects_in_the_REST_API.html

[carstenlymann1 · Accepted solution]

I would say RestAPI as well.

It need some programming skills but its fun to learn, and really usable with other stuff as well later on.

If you have no programming experience, i would get help. And try if it can be programmed together with the help, so you learn at the same time.. 

I got a script some where i can share at some point. I just need to make sure i dont have any company secret data in it. 

But it creates the objects. (not the rules) 

I can recommend looking in here: https://developer.cisco.com/secure-firewall/management-center/

It has a sandbox where you can try and error without destroying anything on your site. 

[loc.nguyen]

Hi Carsten,

I  found  a link for creating objects. Is it the one you are talking about?

https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/215972-push-objects-in-bulk-to-fmc-using-rest-a.html

I appreciate it if you can share any scripts.

Thanks

Loc

[carstenlymann1 · Accepted solution]

That link looks correct yet.

Im busy the next couple of days. I might be able to share some script ideas Tuesday or Wednesday. (Have not used it for more than a year, so need to take a closer look and try it out so im sure it still working). 

I have not looked at the script mentioned below but found this shared in the community earlier from Shubham Bharti:

https://github.com/shubhambharti89/BulkPushObjectsFMC/tree/master/URL-Obj

[loc.nguyen]

I have a follow up question. 

I can create the object using the python script.

Now my object group looks like below from the command line of a FTD:

ctrma-ftd-1# show run object-group id CTRMA_CCRMA_PRENAT_GROUP

object-group network CTRMA_CCRMA_PRENAT_GROUP
network-object object ctrma-maint2-036
network-object object ctrma-maint2-151
network-object object ctrma-maint2-030

Is there a way to make it organized by name?

I need it to be as below:
 object-group network CTRMA_CCRMA_PRENAT_GROUP
network-object object ctrma-maint2-030
network-object object ctrma-maint2-036
network-object object ctrma-maint2-151

FYI: I need to NAT one-to-one so I need the object list need to sort by name. 

THanks

Loc

[carstenlymann1]

Cool. Great work..

Im not sure if its possible to organize it. Cisco do try to get us away from using cli, so not sure it can be done. 

Makes most sense to me that it should be in the order entered on the device, but never looked at my automation in cli afterwards.