Cannot iterate ips_ipv4_access_rules of smc.base.model.SubIpv4IpsPolicyDynamic about fp-ngfw-smc-python HOT 5 CLOSED

Hello,

I don't use SMC 6.8 but in my opinion there is two things that may be "wrong" in your code:

• Action is in "rule.action.action"
• SubPolicy cannot have IPS rules, only FW rules (so rule.action.sub_policy.fw_ipv4_access_rules)

Does it help?

Etienne

from fp-ngfw-smc-python.

Sorry that you had to wait so long:

Action is in "rule.action.action"
action is a local variable in this case, that contains rule.action.action

SubPolicy cannot have IPS rules, only FW rules (so rule.action.sub_policy.fw_ipv4_access_rules)

<class 'smc.base.model.SubIpv4IpsPolicyDynamic'> object has no attribute 'fw_ipv4_access_rules'>

print(type(rule.action.sub_policy))
<class 'smc.base.model.SubIpv4IpsPolicyDynamic'>
print(vars(rule.action.sub_policy.data))

{
    "_etag": '"OTY0MTM3MTE2MjE1MDYxNzA4NDU="',
    "data": {
        "key": 96,
        "link": [
            {
                "href": "https://...:8082/6.5/elements/sub_ipv4_ips_policy/96",
                "rel": "self",
                "type": "sub_ipv4_ips_policy",
            },
            {
                "href": "https://...:8082/6.5/elements/sub_ipv4_ips_policy/96/export",
                "rel": "export",
            },
            {
                "href": "https://...:8082/6.5/elements/sub_ipv4_ips_policy/96/history",
                "rel": "history",
            },
            {
                "href": "https://...:8082/6.5/elements/sub_ipv4_ips_policy/96/search_category_tags_from_element",
                "rel": "search_category_tags_from_element",
            },
            {
                "href": "https://...:8082/6.5/elements/sub_ipv4_ips_policy/96/duplicate",
                "rel": "duplicate",
            },
            {
                "href": "https://...:8082/6.5/elements/sub_ipv4_ips_policy/96/force_unlock",
                "rel": "force_unlock",
            },
            {
                "href": "https://...:8082/6.5/elements/sub_ipv4_ips_policy/96/search_rule",
                "rel": "search_rule",
            },
            {
                "href": "https://...:8082/6.5/elements/sub_ipv4_ips_policy/96/duplicate_as_l2_interface",
                "rel": "duplicate_as_l2_interface",
            },
            {
                "href": "https://...:8082/6.5/elements/sub_ipv4_ips_policy/96/open",
                "rel": "open",
            },
            {
                "href": "https://...:8082/6.5/elements/sub_ipv4_ips_policy/96/save",
                "rel": "save",
            },
            {
                "href": "https://...:8082/6.5/elements/sub_ipv4_ips_policy/96/ips_ipv4_access_rule",
                "rel": "ips_ipv4_access_rules",
                "type": "ips_ipv4_access_rule",
            },
        ],
        "name": "Land/Region",
        "read_only": False,
        "system": False,
        "system_key": -1,
    },
}

if I interpret the data correctly, there should be a list of access rules at rule.action.sub_policy.ips_ipv4_access_rules
or am I missing something important?

from fp-ngfw-smc-python.

Sorry that you had to wait so long:

Action is in "rule.action.action"
action is a local variable in this case, that contains rule.action.action

SubPolicy cannot have IPS rules, only FW rules (so rule.action.sub_policy.fw_ipv4_access_rules)

<class 'smc.base.model.SubIpv4IpsPolicyDynamic'> object has no attribute 'fw_ipv4_access_rules'>

print(type(rule.action.sub_policy))
<class 'smc.base.model.SubIpv4IpsPolicyDynamic'>
print(vars(rule.action.sub_policy.data))

{
    "_etag": '"OTY0MTM3MTE2MjE1MDYxNzA4NDU="',
    "data": {
        "key": 96,
        "link": [
            {
                "href": "https://...:8082/6.5/elements/sub_ipv4_ips_policy/96",
                "rel": "self",
                "type": "sub_ipv4_ips_policy",
            },
            {
                "href": "https://...:8082/6.5/elements/sub_ipv4_ips_policy/96/export",
                "rel": "export",
            },
            {
                "href": "https://...:8082/6.5/elements/sub_ipv4_ips_policy/96/history",
                "rel": "history",
            },
            {
                "href": "https://...:8082/6.5/elements/sub_ipv4_ips_policy/96/search_category_tags_from_element",
                "rel": "search_category_tags_from_element",
            },
            {
                "href": "https://...:8082/6.5/elements/sub_ipv4_ips_policy/96/duplicate",
                "rel": "duplicate",
            },
            {
                "href": "https://...:8082/6.5/elements/sub_ipv4_ips_policy/96/force_unlock",
                "rel": "force_unlock",
            },
            {
                "href": "https://...:8082/6.5/elements/sub_ipv4_ips_policy/96/search_rule",
                "rel": "search_rule",
            },
            {
                "href": "https://...:8082/6.5/elements/sub_ipv4_ips_policy/96/duplicate_as_l2_interface",
                "rel": "duplicate_as_l2_interface",
            },
            {
                "href": "https://...:8082/6.5/elements/sub_ipv4_ips_policy/96/open",
                "rel": "open",
            },
            {
                "href": "https://...:8082/6.5/elements/sub_ipv4_ips_policy/96/save",
                "rel": "save",
            },
            {
                "href": "https://...:8082/6.5/elements/sub_ipv4_ips_policy/96/ips_ipv4_access_rule",
                "rel": "ips_ipv4_access_rules",
                "type": "ips_ipv4_access_rule",
            },
        ],
        "name": "Land/Region",
        "read_only": False,
        "system": False,
        "system_key": -1,
    },
}

if I interpret the data correctly, there should be a list of access rules at rule.action.sub_policy.ips_ipv4_access_rules
or am I missing something important?

You are right, rule.action.sub_policy.ips_ipv4_access_rules should return a list of rules..
It seems due to SubIpv4IpsPolicyDynamic element is dynamically created and doesn't support ips_ipv4_access_rule..

I created an issue in Forcepoint Github Enterprise.

Thomas.

from fp-ngfw-smc-python.

Issue is fixed and will be published in next release

you will be able to retrieve IPS sub rules using: (@see examples/sub_policies.py)

        # retrieve rules for ips sub policy
        jump_rule = ips_policy.search_rule("ips_jump_rule")
        if jump_rule[0].action.action[0] == "jump":
            for r in jump_rule[0].action.sub_policy.ips_ipv4_access_rules.all():
                print("sub ips rule:{}".format(r))

from fp-ngfw-smc-python.

Thanks. I will close the issue once I am able to check.

from fp-ngfw-smc-python.