Using ERS API to create dACL

[orp]

Hi,

In ISE 2.4 it seems that it's possible to create dACLs using ERS. I couldn't find documentation for actually setting the rules in the dACL, e.g. permitting traffic for specific IPs, permit/deny, etc.

Can it be done? If so, what's the json format for that? If not, what's the purpose of this API?

Thanks

[thomas · Accepted solution]

The ACL format would need to match the ACL format of the network device.

So assuming an IOS switch:

curl --include --header 'Content-Type:application/json' --header 'Accept: application/json' --user admin:C1sco12345 --request POST https://1.2.3.4:9060/ers/config/downloadableacl --data '

{

  "DownloadableAcl" : {

    "name" : "ALLOW_ALL",

    "description" : "Allow all.",

    "dacl" : "

remark Allow All

permit ip any any

"

  }

}'