We have the 2100 series Firepower in a 2-node cluster (v6.2+) managed by FMC (v6.3+). When we migrated from the ASA, the network objects and port objects from the configuration moved over as very generic names in the new configuration. We haven't touched many of the old objects and now need to consolidate and clean up a lot of older policies, and this makes the policies difficult to read or understand without looking up what each object is, and there are a lot of duplicate objects in use as a result.
There's no built-in feature that I'm aware of that can export a human-readable file (CSV, Excel, etc.). I was able to find a script here that can export the policies, but it's not supported by Cisco yet (as far as I know) and only exports the policies, not the objects used in the policies. FMC is supposedly capable of exporting policies and objects, but the file it exports isn't human readable (.sfo) and I'm not quite sure how to use the REST API functions with scripting.
We need to get a listing of objects since there are hundreds of them, and we would like to use that list to clean up and consolidate and have a record of what's there now before any changes are made. I realize there are APIs but it can be difficult since I don't really do much scripting, and since the instructions are hard to find to get this done properly. Is there some easy way of doing this, or at least step-by-step instructions on how to do this in a Linux environment? I had to install python 3 and pip3 (I had someone else install it for me) to get the above script to work.
Is there another script or a way to then make those changes to the objects and thus the policies? It's quite risky to do all at once, I would imagine, but if we do chunks instead of one by one, that would save a lot of time and work. Thanks.
