Put API L3 firewall rules

[jasonrakers]

I am using Postman to interact with the API and seem to be stuck on how to issue a PUT for L3 firewall rules. I have a parameter of "rules" with a value of the array as defined in the attached -

I get a 200 message, but when I GET the network the firewall rules have not been modified.

I've also tried defining a "rules": array in the body (as shown in the online Meraki API documentation) with no different results.

Guidance would be appreciated.

Sample array used in the value field attached

{
        "comment": "allow https - corp internet",
        "policy": "allow",
        "protocol": "tcp",
        "srcPort": "Any",
        "srcCidr": "10.0.0.0/8",
        "destPort": "443",
        "destCidr": "Any",
        "syslogEnabled": false
    },
    {
        "comment": "allow ssh - corp internet",
        "policy": "allow",
        "protocol": "tcp",
        "srcPort": "Any",
        "srcCidr": "10.0.0.0/8",
        "destPort": "22",
        "destCidr": "Any",
        "syslogEnabled": true
    }

[simple818]

I haven't added a rule via API before but I have two observations.

1. The documentation says "Update L3 Firewall Rules" so I wonder if you are only allowed to update and not add. It doesn't clarify

2. The rules array appears to be required and make sure to pay attention that it uses a bracket instead of the curly brace so I assume the body of the postman request would be formatted similar to this

{
  "rules": [
      {
        "comment": "allow https - corp internet",
        "policy": "allow",
        "protocol": "tcp",
        "srcPort": "Any",
        "srcCidr": "10.0.0.0/8",
        "destPort": "443",
        "destCidr": "Any",
        "syslogEnabled": false

[jasonrakers]

{
 	"rules": [
 	{
        "comment": "allow https - corp internet",
        "policy": "allow",
        "protocol": "tcp",
        "srcPort": "Any",
        "srcCidr": "10.0.0.0/8",
        "destPort": "443",
        "destCidr": "Any",
        "syslogEnabled": false
    },
    {
        "comment": "allow ssh - corp internet",
        "policy": "allow",
        "protocol": "tcp",
        "srcPort": "Any",
        "srcCidr": "10.0.0.0/8",
        "destPort": "22",
        "destCidr": "Any",
        "syslogEnabled": true
    }
	]
}

this is what I have tried in the body, I am thinking the value in my params field is not correct, but not sure on what other format it should be in.

You might be onto something with the "Update firewall rule" language instead of "Add", but I tried adding additional destination ports and/or source CIDR in a rule, keeping the same rule order as retrieved in a GET, but the modified rules do not reflect the changes on another GET.

[jasonrakers · Accepted solution]

I have resolved my issue. As instructed in the API documentation I have been using the "params" key of "rules" and a "value" of the array. The body also contained the array as the example code indicated. If I removed the params key of rules, than I would receive the following error:

404 Bad Request

{ 
     "errors": [
         "Missing parameter -  the \"rules\" parameter is required"
      ]
}

I imported the sample curl example from the Meraki API documentation into Postman and noticed that the params did not include anything, only the body with the array. I updated my request accordingly and now L3 firewall rules are updated. As a note, the firewall replaces any existing rules with the array contents. So to update a single rule you would need to include all the rules.

[simple818]

Thanks for following up on this. I was curious what the resolution would be.

[imontalvo]

Hi Guys,

I've been testing with APIs adding adddresses, names, getting networks, devices, etc.

I was trying to add L3 rules into an MX and this really helped since I had the RULES missing parameter, but after doing some testing I'm encountering the following issue.

If I try to add one rule:

[
{
"comment": "Test Rule",
"policy": "deny",
"protocol": "any",
"srcPort": "Any",
"srcCidr": "10.10.37.5/32",
"destPort": "Any",
"destCidr": "10.10.36.0/24",
"syslogEnabled": false
},
{
"comment": "Default rule",
"policy": "allow",
"protocol": "Any",
"srcPort": "Any",
"srcCidr": "Any",
"destPort": "Any",
"destCidr": "Any",
"syslogEnabled": false
}
]

I get a 200OK but no addition was made, ever further if I enter a rule manually in the portal and I run the same script everything gets deleted and I get the a 200OK but it deletes all the existing rules but the default one.

any guidance would be great.

BTW I'm doing this with postman

[jasonrakers]

That appears to be the API behavior. You need to define the entire rule set. So if you want to add a rule, you include all the rules plus your addition. Same from removal of a rule. All the rules minus the deleted rule. Weird but it works.

[imontalvo]

Thanks for your reply.

I've just tried that last time, I first got the existing rules qith a GET, then I PUT the existing rules plus a new one at the top or at the bottom, and does the same the outcome is deletion of the existing rules but the default one.

[33]

On the same topic, have a side question... is there a way to add the same firewall rule to multiple networks??? I know how to do with one network because of you have to define a networkID but what about applying to few networks or all thru Postman?

[CBurkhead]

Don't know if you are still wanting to do this, but to my knowledge there is not a way to do this via Postman. Admittedly, I don't use Postman, but when I was looking at it I did not get the impression that you could do something like this. You can however do this via a language like Python. I have a script that allows me to access any L3 rules in any MX network in any organization and copy them to another network or networks.

If you are interested in something like this, I can give you more information.

[33]

Yes please! I am starting to learn Python just for this purpose so it will help me lot if you could give me any more information.

[CBurkhead]

No problem. Do you know if there is an easy way to talk out of the forum? I want to get an idea of what you have done so far and that does not need to be a public discussion. I will also give you the script I wrote and help you to understand what it is doing and modify it to meet your needs.

[CarolineS-Meraki]

---

@CBurkhead wrote:

Do you know if there is an easy way to talk out of the forum? I want to get an idea of what you have done so far and that does not need to be a public discussion.

---

Hi @CBurkhead - I just granted you Private Message permissions (typically they're granted automatically after a certain amount of activity on the forums), so you and @33 can exchange contact info privately.

[CBurkhead]

Thank you very much! That will help a great deal.

[srajiwate]

You can use postman collection runner where you have to create a networkID variable and to provide data for that variable you can upload a datasheet with multiple networkids