[info request] DHCP relay and access NAT rules

[giovanniaugusto-cs50]

Thank you for your efforts on this,

I would like to know if it is possible to configure DHCP relay, I cannot find any reference for it anywhere, honestly neither in the API explorer.

Also I'd like to access the NAT rules for a specific Policy attached to a firewall to verify that a NAT rule exist before creating it but I am not able to retrieve it.

Furthermore I am not seeing all policy attached to a device or an HA pair while fetching the devicerecord, is there a way to do so?

How to access flexconfig policies?

thanks

[manofcolombia]

Currently not directly supported by this library at this time, but dhcp relay in api explorer(fmc 7.4.1) should be: /api/fmc_config/v1/domain/{domainUUID}/devices/devicerecords/{containerUUID}/dhcp/dhcprelaysettings/{objectId}

NAT policy can be found with FTDNatPolicies class. NAT rules can then be accessed via classes based on nat rule type: AutoNatRules, ManualNatRules, NatRules.

For "all policy attached to a device or an HA pair", try using devicerecords with expanded=True and includeOtherAssociatedPolicies=True. Example found in devicerecords unit_test:

    all_device_records = fmcapi.DeviceRecords(fmc=fmc)
    all_device_records.get(expanded=True, includeOtherAssociatedPolicies=True)
    # Note: attached RAVPN policies output from 'includeOtherAssociatedPolicies=True'
    # have the INCORRECT UUID. Bug ID: CSCwj27112. This can be worked around for now
    # by subtracting 1 from the UUID in the response. This has ONLY been observed with
    # devicerecords api + 'includeOtherAssociatedPolicies=True' + ravpn policies.

[giovanniaugusto-cs50]

Hi, I tried with includeOtherAssociatedPolicies=True But I could only enumerate the access policies in the ouput list. Is maybe because I am on version 7.0.6.2?

…

On Thu, May 2, 2024, 16:14 Zak Lantz ***@***.***> wrote: Currently not directly supported by this library at this time, but dhcp relay in api explorer(fmc 7.4.1) should be: /api/fmc_config/v1/domain/{domainUUID}/devices/devicerecords/{containerUUID}/dhcp/dhcprelaysettings/{objectId} NAT policy can be found with FTDNatPolicies class. NAT rules can then be accessed via classes based on nat rule type: AutoNatRules, ManualNatRules, NatRules. For "all policy attached to a device or an HA pair", try using devicerecords with expanded=True and includeOtherAssociatedPolicies=True. Example found in devicerecords unit_test: all_device_records = fmcapi.DeviceRecords(fmc=fmc) all_device_records.get(expanded=True, includeOtherAssociatedPolicies=True) # Note: attached RAVPN policies output from 'includeOtherAssociatedPolicies=True' # have the INCORRECT UUID. Bug ID: CSCwj27112. This can be worked around for now # by subtracting 1 from the UUID in the response. This has ONLY been observed with # devicerecords api + 'includeOtherAssociatedPolicies=True' + ravpn policies. — Reply to this email directly, view it on GitHub <#198 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BHOZXJCEDO5EURH2VIOEC23ZAJC5LAVCNFSM6AAAAABHDQKYAWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAOJQGYYDINRVGM> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[manofcolombia]

Very likely. I have only tested this on 7.4+

[manofcolombia]

Here is what 7.4.1 api explorer looks like for that api endpoint. Also, make sure you are using includeOtherAssociatedPolicies=True WITH expanded=True. I noticed that without expanded includeOtherAssociatedPolicies doesn't work properly. Not sure if that's intended by Cisco or not.