API based tool to save the Access Control Policy from FMC as CSV

[Raghunath Kulkarni]

Hello Everyone,

Very often as Network Administrator there is a need to save the ACP on the Firepower Management Center(FMC) as CSV, while the FMC in itself supports the policy import and export option as a full-fledged feature there is no way to save the ACP as CSV.

The script attached here solves the problem, however, this is not a replacement for the backup features from FMC.

Note: This tool by no means is a replacement for the policy import and export option of FMC. This tool is intended to have the CSV generated for ACP.

It does not take the backup of the objects or IPS/File Policy associated, it just gives a listing of the configuration.

What is supported:

1. Policy extraction from the FMC over API.
2. Extracts Zones, Networks, Applications, URL's, Users, IPS Policy, File Policy, Variable Sets, Logging configurations.
3. The output format is in CSV with ";" separated multiple entries within a specific field.
4. Currently supported only on FMC, no FDM support available.

Upcoming features:

1. Auto-listing of available policies across the domains.
2. Support for ISE/SGT attributes.

3. Writing the CSV backup as ACP to the FMC.

Link on Devnet: 

https://developer.cisco.com/codeexchange/github/repo/raghukul-cisco/csvExportFirepower/

The tool will be updated every month with new features wherever applicable.

#Firepower #FMC

P.S: This is not an official tool, so please leave your comment/feedback below and we will try our best to address it as soon as possible.

Version 3: Support for large rule sets. @Anupam Pavithran 

@Anupam Pavithran

[SYEDMAHMOODAHMED2843]

@Anupam

Thank you for your support man, it worked out. Much appreciated!!

[CSCO11853579]

Anyone managed to get this working to export the NAT policies please?

[Konstantinos Gerakaris]

Hi.

Thank you for this very valuable tool.

Is there any projection when the feature of uploading back the CSV to the FMC as an ACP will be available on your script?

Thank you in advance!

[msameerkn]

Hi Anupam , 

I have tested ACP export policy on Python Version 3.9 , working as expected . could you please provide the script to export pre filter policy rules . 

B.Regards 

Sameer . 

[Toothless]

nvm .. issue resolved

[CSCO11853579]

Hi Raghunnath and team

Anyone managed to get this working to export the NAT policies please?

[BrettHallahan24563]

So Policy CSV.zip works fine for me. The Policy CSV-rel2 won't accept input unless I quote it; e.g., 

Traceback (most recent call last):
File "C:\BIN\Python\Policy CSV-rel2\Policy CSV\Export-Policies.py", line 23, in <module>
device = input("Enter the device IP address: ")
File "<string>", line 1
172.28.12.12
^
SyntaxError: invalid syntax

Then, after putting quotes around every prompt response, it pauses, then I receive:

auth_token not found. Exiting...
{'X-XSS-Protection': '1; mode=block', 'X-Content-Type-Options': 'nosniff', 'Content-Security-Policy': "base-uri 'self'", 'Transfer-Encoding': 'chunked', 'Accept-Ranges': 'bytes', 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains', 'Server': 'Apache', 'Connection': 'close', 'X-UA-Compatible': 'IE=edge', 'Cache-Control': 'no-store', 'Date': 'Tue, 08 Jun 2021 21:31:35 GMT', 'X-Frame-Options': 'SAMEORIGIN', 'Referrer-Policy': 'same-origin', 'Content-Type': 'application/json', 'X-Permitted-Cross-Domain-Policies': 'none'}

Release 3; this is all I get:

I'm at a total loss. We're doing a PCI audit soon, and having the comments would help, immensely.  Any thoughts? I have Python 2.7.16 on Windows 10

Thanks

[BrettHallahan24563]

Nevermind; I uninstalled all Python instances and reinstalled Python 3.9.5, then installed the pre-requisites. After that, all releases worked. Thanks!

[andrewjinks]

Do you know what version of Python this works with on Red Hat?  Looks like Red Hat 8 is distributed with 3.6 and we're running Red Hat 7 which currently has version 2.7.5

I need to export policies (with comments) and Objects (networks and ports).

[ChrisDunkum8217]

This worked absolutely great, until it hit a rule with multiple comments. . . a result of copying rules.

Do you know of any work around ?

EDIT: I was able to get rel2 to work and indeed a previous reply is correct it creates a new line there.

[MacFergus]

WOW! So cool!  I got the original version to work on 2021-11-18.  rel3 error'd for me.  But THANK YOU FOR THIS!  To be able to spit out several hundred rules into a CSV is such a gift!!!  Please keep this working...and please give some detailed instructions (as if you were explaining to a total newb [not to be confused with noob]) about how to make it work--it assumes that folks already know stuff...which fortunately from a Macbook terminal, I knew to:

run "python --version" then "unzip Policy\ CSV.zip" then "cd Policy\ CSV" then "less README.MD" which told me to "pip install -r fireREST/requirements.txt" and finally "python Export-Policies.py" which starts the script to gather IP address, user/pass, domain, policy-name ...then it spat out the csv file.

[BRAC_ENS]

Hi

we have notes saved for each acl in the comment section. This note includes symbols like , ; < > & etc and some of the comments have multiple lines. So, when we are exporting the csv file, it gets scattered due to the "multiple lines". Could you please take this into consideration for next release?

Thanks

[paulwoolnough]

Thanks for the tool, very helpful.

A couple of observations from using. When there is a subnet/IP address configured on an ACP (which is not an actual object on the FMC) the script fails and stops processing entries.

Also for some reason in my generated output each entry has a u in front of it - ie. as follows;

[u'CAMPUS-CCTV-MANAGEMENT', u'CAMPUS-CCTV-NETWORK']

Doesn't make any difference what field the entry is in ie. source, destination etc.

Has anyone come across other useful scripts like this?

Thanks

Paul

[Raghunath Kulkarni]

Thanks, Paul, for the feedback. We are happy that the tool is helpful and addresses the need.

Coming to the concerns flagged, 

1. Regarding the subnet/IP address configured on ACP where the script fails, can you please provide an example (please use a private IP address in the example so that it is generic in nature)? Based on our testing of the latest version uploaded we did not see any such issues hence it would be good to know if we missed any specific combination.
2. The character 'u' that is printed is the Unicode character. Again the latest version that was uploaded should not have this problem. What version of python do you have installed? The latest build works for python 3. X and above.

We are currently working on a newer build which we intend to make it available by Feb mid to include some additional features.

[FrM]

Hi Raghunath

First, congratulations for this great tool..

I discover a problem when I have more than 2 objects as source Networks.

In this case the third source object become a Dest Network

Same problem with more than 2 Dest Networks.

Maybe an idea or a workaround ?

Thank you

Kind regards

Franck