API call for nat-policy-addresses

[Jacopo_Vigano]

Hello Community,

we would use an API to see the output of show running nat-policy-addresses command for each vsys.

The following API work properly when on the firewall there is only one vsys.

https://<firewall-IP>/api/?type=op&cmd=%3Cshow%3E%3Crunning%3E%3Cnat-policy-addresses%3E%3C%2Fnat-policy-addresses%3E%3C%2Frunning%3E%3C%2Fshow%3E&key=<APIKEY>

We have multiple virtual system and we need to have the output for each vsys.

From CLI we get it with two different command:

>set system setting target-vsys <value>

and 

>show running nat-policy-addresses

It seems there is no way to specify the vsys into this specific API call.

Do you know if is it possible to have this information?

Thanks in advance.

Jacopo

[Sly_Cooper]

Hope this helps.

Change the vsys to specific vsys number. 

CLI:

show config running xpath devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/nat/rules

API:

"<show><config><running><xpath>devices/entry[@name=&apos;localhost.localdomain&apos;]/vsys/entry[@name=&apos;vsys1&apos;]/rulebase/nat/rules</xpath></running></config></show>"

[Jacopo_Vigano]

Hi @Sly_Cooper,

Thanks for your help. The API that you suggested retrive the NAT rulebase and not nat-policy-addresses.

We need to retrive the IP addresses and not the name of objects used into the NAT rules.

Thanks in advance.

Jacopo

[JoeAndreini]

You should be able to append  "&vsys={vsys_name}" to your request to target a specific vsys

This should work for any op command in a multi-vsys system

[Sly_Cooper]

@Jacopo_ViganoI have similar requirements and I am trying to solve the problem via python script (work in progress). I dont think there is any direct way to map address to ip.

[Jacopo_Vigano]

@Sly_Cooper, I'm quite sure that with a script should work fine.

Thanks!

Jacopo