Site-to-site outbound firewall Rules Export

[Zbeggy]

I need to export a large list of Site-to-site outbound firewall rules.  After spending some time doing research on the API calls I cannot locate what I'm looking for.  Is it possible to export a list of these rules using the API via postman?

[alemabrahao · Accepted solution]

Yes, it is.

https://api.meraki.com/api/v1/organizations/:organizationId/appliance/vpn/vpnFirewallRules

https://developer.cisco.com/meraki/api-v1/get-organization-appliance-vpn-vpn-firewall-rules/

[Zbeggy]

That first link appears to be broken,  I tried the second one and I'm getting a 404 Not Found.

[alemabrahao]

The first one is the API and it doesn't load at all, the second one is working as expected.

[Zbeggy]

The second link works yes, but when I run that Get command it returns a 404 not found. 

Get          {{baseUrl}}/networks/{organizationId}/appliance/vpn/vpnFirewallRules

[alemabrahao]

You need your organization ID and in addition you need to create an API key in your dashboard.

https://developer.cisco.com/meraki/api-v1/get-organizations/

http://documentation.meraki.com/General_Administration/Other_Topics/Cisco_Meraki_Dashboard_API

[Zbeggy]

I have my Org ID and I was able to set my API key as a variable.

[alemabrahao]

Did you add the correct headers?

[Zbeggy]

I believe so yes.

[alemabrahao]

Is the Scanning API enabled? Network-wide > General

[Zbeggy]

I do not seem to have a location and scanning section under network-wide>General.

[alemabrahao]

You can try it via Powershell

$headers = @{
"Authorization" = "Bearer YOUR_API_KEY"
"Accept" = "application/json"
}

$url = "https://api.meraki.com/api/v1/organizations/YOUR_ORG_ID/appliance/vpn/vpnFirewallRules"

$response = Invoke-RestMethod -Uri $url -Method Get -Headers $headers

$response

[Zbeggy]

Using PS I get this...


Invoke-RestMethod : The remote server returned an error: (401) Unauthorized.
At line:6 char:13
+ $response = Invoke-RestMethod -Uri $url -Method Get -Headers $headers
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebException
+ FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand

[alemabrahao]

Either your API key is incorrect or you don't have API scanning enabled. I believe it's the latter, as I validated it here and it worked perfectly.

[Zbeggy]

API key works for other tests like getOrganizationID and Get l3FirewallRules.

I do not seem to have a location & scanning section either in general or under org>location anaylytics.

For Meraki dashboard users

• Enable Location Analytics:

  • Go to Organization > Location Analytics and verify analytics are enabled. 
  • Navigate to Network-wide > Configure > General and ensure "Location and scanning > Analytics" is enabled for the specific network. 

[alemabrahao]

This is the correct path Network-wide > Configure > General and ensure "Location and scanning .

Are you full admin? If you don't enable this it won't work.

[Zbeggy]

I am a full admin, double and triple checked that page and found nothing.  I'll have to reach out to support to confirm.

I appreciate your help!!

[alemabrahao]

Last question: Does Analytics appear to you? It needs to be enabled to enable API scanning.

[Zbeggy]

It must be enabled because it worked and I got analytics but the objects aren't showing up as the names or IPs, its all just a string of random numbers.  

Is that for security reasons or is there a way I can get this to show the actual objects/IPs?

[alemabrahao]

I don't know the reason, I believe what is displayed is the object code in Meraki, but I can't explain why the name isn't displayed.

[alemabrahao]

It's a little further down in Location and scanning.

[PhilipDAth]

If you use the link that @alemabrahao gave you:
https://developer.cisco.com/meraki/api-v1/get-organization-appliance-vpn-vpn-firewall-rules/
It has come code you can copy and paste.

[Zbeggy]

When I use that site, instead of postman, I get this.

Failed to execute 'fetch' on 'Window': Invalid name

[Zbeggy]

I also tried to copy/paste it into postman, but I'm just now using Postman for the first time and I don't know where to past it.  I tried putting it under Scripts (pre & post-scripts)

[srajiwate]

https://github.com/srajiwate/SR-Meraki-Mate   you can get your bulk export of firewall rules inbound as well outbound from this python tool 

As well can append, delete Or add rules as well there is option to overide rules

[Zbeggy]

I managed to get it to work!  Apparently I had the wrong URL.  After looking at the first link again I realized mine said networks/orgid instead of organizations/orgid.


Thank you so much for all of your help!!