topic Re: API call for nat-policy-addresses in Automation/API Discussions

API call for nat-policy-addresses

Jacopo_Vigano — Thu, 12 Jul 2018 15:05:41 GMT

Hello Community,

we would use an API to see the output of show running nat-policy-addresses command for each vsys.

The following API work properly when on the firewall there is only one vsys.

https://<firewall-IP>/api/?type=op&cmd=%3Cshow%3E%3Crunning%3E%3Cnat-policy-addresses%3E%3C%2Fnat-policy-addresses%3E%3C%2Frunning%3E%3C%2Fshow%3E&key=<APIKEY>

We have multiple virtual system and we need to have the output for each vsys.

From CLI we get it with two different command:

>set system setting target-vsys <value>

and

>show running nat-policy-addresses

It seems there is no way to specify the vsys into this specific API call.

Do you know if is it possible to have this information?

Thanks in advance.

Jacopo

Re: API call for nat-policy-addresses

Sly_Cooper — Wed, 01 Aug 2018 16:12:07 GMT

Hope this helps.

Change the vsys to specific vsys number.

CLI:

show config running xpath devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/nat/rules

API:

"<show><config><running><xpath>devices/entry[@name=&apos;localhost.localdomain&apos;]/vsys/entry[@name=&apos;vsys1&apos;]/rulebase/nat/rules</xpath></running></config></show>"

Re: API call for nat-policy-addresses

Jacopo_Vigano — Mon, 06 Aug 2018 08:36:00 GMT

Hi @Sly_Cooper,

Thanks for your help. The API that you suggested retrive the NAT rulebase and not nat-policy-addresses.

We need to retrive the IP addresses and not the name of objects used into the NAT rules.

Thanks in advance.

Jacopo

Re: API call for nat-policy-addresses

JoeAndreini — Thu, 09 Aug 2018 14:57:54 GMT

You should be able to append "&vsys={vsys_name}" to your request to target a specific vsys

This should work for any op command in a multi-vsys system

Re: API call for nat-policy-addresses

Sly_Cooper — Tue, 21 Aug 2018 17:10:14 GMT

@Jacopo_ViganoI have similar requirements and I am trying to solve the problem via python script (work in progress). I dont think there is any direct way to map address to ip.

Re: API call for nat-policy-addresses

Jacopo_Vigano — Fri, 24 Aug 2018 12:43:53 GMT

@Sly_Cooper, I'm quite sure that with a script should work fine.

Thanks!

Jacopo