I am trying to configure sub interfaces on a device located in a subdomains . I am unable to make this work. When I use the API-explore I receive the error below. I have also tried using python code below.
Devices:
- FMC virtual 6.6.1
- FTD virtual 6.6.1
API-Explorer error
{
"error": {
"category": "FRAMEWORK",
"messages": [
{
"description": "You do not have the required authorization to do this operation."
}
],
"severity": "ERROR"
}
}
API-Explorer code
{
"type": "SubInterface",
"vlanId": 30,
"subIntfId": 12345,
"enabled": true,
"MTU": 1500,
"managementOnly": false,
"enableAntiSpoofing": true,
"enableSGTPropagate": true,
"ifname": "Intf_name",
"name": "GigabitEthernet0/1",
"overrideDefaultFragmentSetting": {
"size": 200,
"chain": 24,
"timeout": 5
},
"ipv4": {
"static": {
"address": "1.2.3.4",
"netmask": "25"
}
}
}
Python Code error
Response test {"error":{"category":"FRAMEWORK","messages":[{"description":"Invalid Request"}],"severity":"ERROR"}}
Response
<Response [404]>
Python Code
def configure_subinterface(addr: str = None, token: str = None):
print("*" * 80)
print("Create subinterfaces")
db_list0 = {}
db_list1 = {}
with os.scandir('./') as entries:
for entry in entries:
db_list0[entry.name] = entry.name
print("*" * 80)
ftdinterface = selectFromDict(db_list0, 'FTD interface backup to restore')
with open(ftdinterface) as readfile:
subinterface = json.load(readfile)
with os.scandir('./') as entries:
for entry in entries:
db_list1[entry.name] = entry.name
print("*" * 80)
ftdrecord = selectFromDict(db_list1, 'FTD device to apply interface')
print("*" * 80)
with open(ftdrecord) as readfile:
devicerecord = json.load(readfile)
domainuuid = ("e276abec-e0f2-11e3-8169-6d9ed49b625f/ " + devicerecord['items'][0]['metadata']['domain']['id'])
deviceuuid = devicerecord['items'][0]['id']
payload = json.dumps([
{
"type": "SubInterface",
"vlanId": 30,
"subIntfId": 12345,
"enabled": True,
"MTU": 1500,
"managementOnly": True,
"enableAntiSpoofing": True,
"enableSGTPropagate": True,
"ifname": "Intf_name",
"name": "GigabitEthernet0/1",
"overrideDefaultFragmentSetting": {
"size": 200,
"chain": 24,
"timeout": 5
},
"securityZone": {
"id": "a5d02a5e-d1ce-11eb-9144-f657a2d3df95",
"type": "SecurityZone"
},
"ipv4": {
"static": {
"address": "1.2.3.4",
"netmask": "25"
}
}
}
])
api_uri = f"/api/fmc_config/v1/domain/e276abec-e0f2-11e3-8169-6d9ed49b625f/ 7f180e2c-ce4a-489f-57df-000000000001/devices/devicerecords/{deviceuuid}/subinterfaces?bulk=true"
url = "https://" + addr + api_uri
headers = { "X-auth-access-token": token }
response = requests.request("POST", url, headers=headers, data=json.dumps(payload), verify=False)
Accepted Solutions
I believe your issue is with regard to the domain. If you look at the URL:
https://fmc.cisco.com/api/fmc_config/v1/domain/bad037b7-11fa-32d5-caf6-000000000000/devices/devicerecords/421e39c2-e4b8-11eb-9b7e-efd0ba43de90/subinterfaces
Pay special attention to the domain what I did is the following:
1. Added a VFTD and put it in my new subdomain
2. I created a new admin role user that is a member of both global and my sub-domain
First I went into API explorer where the domain was selected as "global"
I received the same error you did when the domain was set as "global" when I swapped it to "Global/child_domain" then I did not get an error and the subinterface was successfully created.
I believe this is just swapping the domain uuid in the URL to the child domain.
My JSON document looked like the following:
{
"type": "SubInterface",
"vlanId": 10,
"subIntfId": 1,
"MTU": 1500,
"enabled": true,
"managementOnly": false,
"mode": "NONE",
"enableSGTPropagate": true,
"ipv4": {
"static": {
"address": "192.168.6.1",
"netmask": "255.255.255.0"
}
},
"ipv6": {
"enableRA": true,
"enableIPV6": false,
"enforceEUI64": false,
"enableAutoConfig": false,
"enableDHCPAddrConfig": false,
"enableDHCPNonAddrConfig": false,
"dadAttempts": 1,
"nsInterval": 1000,
"reachableTime": 0,
"raLifeTime": 1800,
"raInterval": 200
},
"enableAntiSpoofing": false,
"fragmentReassembly": false,
"ifname": "sub2",
"name": "GigabitEthernet0/2",
}
My suggestion is to make sure you have the URL with the correct subdomain and I suspect your issue will be resolved. The deceptive thing is that it looks like you can do a GET with the global URL but you can only do the POST with the child domain in the URL. I suspect the same is also true for PUT.
I believe your issue is with regard to the domain. If you look at the URL:
https://fmc.cisco.com/api/fmc_config/v1/domain/bad037b7-11fa-32d5-caf6-000000000000/devices/devicerecords/421e39c2-e4b8-11eb-9b7e-efd0ba43de90/subinterfaces
Pay special attention to the domain what I did is the following:
1. Added a VFTD and put it in my new subdomain
2. I created a new admin role user that is a member of both global and my sub-domain
First I went into API explorer where the domain was selected as "global"
I received the same error you did when the domain was set as "global" when I swapped it to "Global/child_domain" then I did not get an error and the subinterface was successfully created.
I believe this is just swapping the domain uuid in the URL to the child domain.
My JSON document looked like the following:
{
"type": "SubInterface",
"vlanId": 10,
"subIntfId": 1,
"MTU": 1500,
"enabled": true,
"managementOnly": false,
"mode": "NONE",
"enableSGTPropagate": true,
"ipv4": {
"static": {
"address": "192.168.6.1",
"netmask": "255.255.255.0"
}
},
"ipv6": {
"enableRA": true,
"enableIPV6": false,
"enforceEUI64": false,
"enableAutoConfig": false,
"enableDHCPAddrConfig": false,
"enableDHCPNonAddrConfig": false,
"dadAttempts": 1,
"nsInterval": 1000,
"reachableTime": 0,
"raLifeTime": 1800,
"raInterval": 200
},
"enableAntiSpoofing": false,
"fragmentReassembly": false,
"ifname": "sub2",
"name": "GigabitEthernet0/2",
}
My suggestion is to make sure you have the URL with the correct subdomain and I suspect your issue will be resolved. The deceptive thing is that it looks like you can do a GET with the global URL but you can only do the POST with the child domain in the URL. I suspect the same is also true for PUT.
