FMC-Copying Access rules from an ACP and applying those copied rules to another ACP

[Narayan Dev Sarma]

Is there a way in FMC to copy access rules from an ACP and paste those in another ACP which is already loaded with access rules and applied to an FTD. Actually, will have to 2-3 migrations of ASAs to FTD but at different time frames. So, at last need to have all consolidated as one ACP. Tried inheritance policy option but can't modify the copied rules. 

FMC-ver-6.4.04

[Francesco Molino]

Hi,

There's no way to copy a rule from 1 ACP and paste over another ACP.
The only way would be to use APIs to do so.

[Narayan Dev Sarma]

Thanks for your reply.

Does FMC offers an API to perform this?

[Francesco Molino]

There's no 1 api to do copy/paste specifically but using api you can read at rules for 1 ACP and then re-create them into the other ACP.

[Narayan Dev Sarma]

Thanks. I am still a new learner with APIs but will give a try.

[Marvin Rhoads]

It's not supported - even in FMC 6.6.

If you use CDO management, it is quite easy to do. However CDO cannot (currently) manage a device that is also FMC-managed.

CDO uses the API to interact with managed devices along the lines @Francesco Molino was referring to.

[Narayan Dev Sarma]

Thanks for your reply

[Anupam Pavithran]

Hi Narayan,

We have created a python script for achieving the same. Please check if it's helpful in you case.

https://community.cisco.com/t5/security-documents/fmc-api-based-tool-merge-two-access-control-policy-s-rules-into/ta-p/4109405

[Peter Beshay]

the New version 6.7.0 can do the copy from ACP to another ACP or from Prefilter Policy to another Prefilter Policy

"Copy and move rules between access control and prefilter policies"
https://www.cisco.com/c/en/us/td/docs/security/firepower/670/relnotes/firepower-release-notes-670/features.html