Put API L3 firewall rules

[jasonrakers]

I am using Postman to interact with the API and seem to be stuck on how to issue a PUT for L3 firewall rules. I have a parameter of "rules" with a value of the array as defined in the attached -

I get a 200 message, but when I GET the network the firewall rules have not been modified.

I've also tried defining a "rules": array in the body (as shown in the online Meraki API documentation) with no different results.

Guidance would be appreciated.

Sample array used in the value field attached

{
        "comment": "allow https - corp internet",
        "policy": "allow",
        "protocol": "tcp",
        "srcPort": "Any",
        "srcCidr": "10.0.0.0/8",
        "destPort": "443",
        "destCidr": "Any",
        "syslogEnabled": false
    },
    {
        "comment": "allow ssh - corp internet",
        "policy": "allow",
        "protocol": "tcp",
        "srcPort": "Any",
        "srcCidr": "10.0.0.0/8",
        "destPort": "22",
        "destCidr": "Any",
        "syslogEnabled": true
    }

[Gabriel3]

Hi everyone,

I have a few questions about this PUT API.

I am using a python script to update the L3 firewall rules. My API uses:

requests.put(apiCall, data=json.dumps(payload), headers=headers).json()

Where for payload, I've tried using just the array in the body (as suggested in the post resolution), like this:

payload = [
{
'comment':'Tested',
'policy':'deny',
'protocol':'Any',
'destPort':'Any',
'destCidr':"3.3.3.3/32",
'srcPort':'Any',
'srcCidr':'Any',

},
{
'comment':'Test',
'policy':'deny',
'protocol':'any',
'srcPort':'Any',
'srcCidr':'Any',
'destPort':'Any',
'destCidr':'1.1.1.1/32,2.2.2.2/32'

}

]

And I receive a 200 code, but the rules are not added nor changed.

I've also tried as indicated in the API documentation using the param "rules":

payload = { 'rules' : [
{
'comment':'Tested',
'policy':'deny',
'protocol':'Any',
'destPort':'Any',
'destCidr':"3.3.3.3/32",
'srcPort':'Any',
'srcCidr':'Any',

},
{
'comment':'Test',
'policy':'deny',
'protocol':'any',
'srcPort':'Any',
'srcCidr':'Any',
'destPort':'Any',
'destCidr':'1.1.1.1/32,2.2.2.2/32'

}

]

}

And the same result, code 200 OK, but nothing is updated.

Do you have any clue about what could be wrong?

[Edgar-VO]

I got it working now....

It turns out (in my case) that you can only put IP addresses and IP subnets in the L3 firewall which are part of your network and VPN. Any other will not be accepted nor inserted.

so if 3.3.3.3/32 is not part of your network, it will not work

[33]

For adding firewall rules, the destination network may be outside your subnet so it shouldn't matter whether or not you have it on your network. The rule is just created to allow access to that destination and it can be any address. The routing will figure out where to send next.

[CBurkhead]

You will need the "rules" in your payload for this to work, I am surprised you got the 200 without it being in there. The only thought I had was what your headers value is? I know, particularly on a PUT or POST, if the header is wrong sometimes you will get return codes that look good, but nothing actually happens or something weird happens. Make sure that your header for the PUT contains your API key and {'Content-Type':'application/json'}. You don't need the content type when doing a GET, but I have found you have to have it for a PUT or POST.

[Gabriel3]

Great! That was it!! Thanks @CBurkhead

For my GET I was using the header:

headers = {"X-Cisco-Meraki-API-Key":"<my-API-Key>","Accept":"application/json"}

And I was trying to use the same header for the PUT operation. I was getting code 200 as you well mentioned, however, nothing ever changed.

Then, I followed your suggestion and changed my PUT header to:

headers = {"X-Cisco-Meraki-API-Key":"<my-API-Key>","Content-Type":"application/json"}

And that did it!

Thank y'all for the quick response to this thread. I imagined it would take me weeks to get a response. I'm so happy it was not the case. Kudos!

[33]

This is what I use and I can add rules without issues.

import requests
import json

response = requests.put(url, headers=headers, data=json.dumps(payload))
print(response.json())

[cumar_chan]

Key is to use python (or similar) to make bulk changes.

Use a variable to store the API response and print this out on to screen.

It is usually a <Response [200]> for success

<Response [400]> or <Response [404]> for errors.

To decipher this, you should (in python) parse this into json()

i.e. details = response.json()

print(details)

...you shoud see the exact nature of the error/failure:

in my case I had included some special chars in the comments section on rule 3:

{'errors': ['At least one of your firewall rules is invalid: "ssid[firewall_rules][3][comment] Comment may use only letters, numbers, spaces, and common punctuation".']}

P.S - special chars are allowed if you enter via GUI but not via API seemingly!!!

[Edgar-VO]

Good Morning,

New at this site and topic... I am having the same issues.... i am sending (using postman and python) REST /API calls to the Meraki environment , i get a 200 Ok but no changes at all. In the logs i can see the old and new value being used, but not the ruleset i want/entered.

Somebody got a working python script using the API call : dashboard.mx_l3_firewall.updateNetworkL3FirewallRules()

Or of course something else ....