Meraki MX API - Update Network Appliance Firewall L3 Firewall Rules with object and groups

[Gineesh]

Background:

We are trying some automation to create the Firewall L3 rules using the Meraki MX API calls.

Since the API overwrite the existing rules (except the Default rule), we are following the below approach.

1. we need to fetch the existing rules using Get Network Appliance Firewall L3 Firewall Rules API call
2. Combine the existing rules with new rule (which we need to add).
3. Call Update Network Appliance Firewall L3 Firewall Rules API call and pass the combined list.

This is perfectly working for IP/CIDR/FQDN entries in the source and destination fields. But when we fetch rules with object/object groups in the source/destination field, we are not able to pass the rules back to API. 

API source/destination field only supports: Comma-separated list of destination IP address(es) (in IP or CIDR notation), fully-qualified domain names (FQDN) or 'any'

1. Do we have any workaround or solution to pass the objects/object groups in the source/destination field?
Or

2. Do we have any alternative method to append the rule without overwriting existing rules?

Thanks in advance.

[Crocker · Accepted solution]

1. You pass the Object or Object group via it's object ID, with the following format: GRP(################) or OBJ(############). You can find the object ID's by querying these endpoints:

• /organizations/$orgID/policyObjects - This will get you the individual objects
• /organizations/$orgID/policyobjects/groups - This will get you the groups
• /organizations/$orgID/policyobjects/groups/$policyobjectgroupID - This will get you more detailed information about the groups if you need

2. Not currently, or at least not that I've found. I query the existing ruleset, store it, append my new rule(s), then PUT it like you describe

[Gineesh]

@Crocker 

Thank you for your reply. 

yes, managed to get it worked by using uppercase GRP/OBJ (I was using the default grp/obj instead) options.
Look like this is the only option so far.

Thank you again.