Cisco Cisco Security Manager 4.1 User Manuals

Table of Contents

• Cisco Security Manager 4.4 API Specification

  1
• (Version 1.1)

  1
• Version 1.0 Published: June 14, 2012

  1
• Version 1.0 Revised: July 10, 2012 (added sample programs to Section 8)

  1
• Table of Contents

  2
• List of Figures

  4
• List of Tables

  8
• 1 Overview

  11
  • 1.1 Scope

    11
  • 1.2 Changes since previous version

    12
    • 1.2.1 Unified Access Rules

      12
    • 1.2.2 Security Policy Object

      12
    • 1.2.3 Network object

      12
    • 1.2.4 Return user/ticket that last modified a config rule.

      12
    • 1.2.5 Add device status – up/down as part of the event service

      12
    • 1.2.6 Exec command API call will be supporting custom timeouts.

      12
    • 1.2.7 API enhancement to return list of all the shared Policies defined in CSM.

      12
    • 1.2.8 Return the Device’s SysObjectID in the Device Object.

      13
    • 1.2.9 CSM Audit Logs should differentiate between logins through API and CSM client.

      13
    • 1.2.10 New Firewall Policies

      13
  • 1.3 Audience

    13
  • 1.4 References

    13
  • 1.5 Glossary

    14
  • 1.6 Conventions

    14
  • 1.7 Overview of CSM Message Flows

    16
  • 1.8 Licensing

    17
  • 1.9 Prerequisites

    18
  • 1.10 API Administration Settings

    18
  • 1.11 Debug Settings

    19
• 2 Common Service API

  20
  • 2.1 Object Model

    20
    • 2.1.1 Object Identifier

      20
    • 2.1.2 Base Object

      20
    • 2.1.3 Device

      21
      • 2.1.3.1 Interface

        23
      • 2.1.3.2 Firewall Capabilities

        24
    • 2.1.4 DeviceGroup

      24
    • 2.1.5 Port Identifier

      25
    • 2.1.6 BaseError

      26
  • 2.2 Methods

    28
    • 2.2.1 Common Request & Response

      28
      • 2.2.1.1 Pagination

        28
    • 2.2.2 Method login

      29
      • 2.2.2.1 Request

        29
      • 2.2.2.2 Response

        31
    • 2.2.3 Method logout

      34
      • 2.2.3.1 Request

        34
      • 2.2.3.2 Response

        35
    • 2.2.4 Method: ping

      35
      • 2.2.4.1 Request

        36
      • 2.2.4.2 Response

        36
• 3 CSM Configuration Service API

  38
  • 3.1 Object Model

    38
    • 3.1.1 Base Policy

      38
    • 3.1.2 BasePolicyObject

      41
    • 3.1.3 Policy Utility Classes

      43
    • 3.1.4 PolicyObject Derived Classes

      45
      • 3.1.4.1 NetworkPolicyObject

        45
      • 3.1.4.2 IdentityUserGroupPolicyObject

        46
      • 3.1.4.3 PortListPolicyObject

        48
      • 3.1.4.4 ServicePolicyObject

        49
      • 3.1.4.5 InterfaceRolePolicyObject

        51
      • 3.1.4.6 TimeRangePolicyObject

        52
      • 3.1.4.7 SLA Monitor Policy Object

        54
      • 3.1.4.8 Standard ACE Policy Object

        56
      • 3.1.4.9 Extended ACE Policy Object

        56
      • Figure 35: ExtendedACEPolicyObject XML Schema

        57
      • 3.1.4.10 ACL Policy Object

        58
      • 3.1.4.11 SecurityGroupPolicyObject

        58
    • 3.1.5 Policy Derived Classes

      60
      • 3.1.5.1 DeviceAccessRuleFirewallPolicy

        60
        • 3.1.5.1.1 Policy Config Device Response Example

          63
      • 3.1.5.2 DeviceAccessRuleUnifiedFirewallPolicy

        66
      • 3.1.5.3 DeviceStaticRoutingFirewallPolicy

        67
      • 3.1.5.4 DeviceStaticRoutingRouterPolicy

        69
      • 3.1.5.5 DeviceBGPRouterPolicy

        71
      • 3.1.5.6 InterfaceNATRouterPolicy

        73
      • 3.1.5.7 InterfaceNATStaticRulesRouterPolicy

        74
      • 3.1.5.8 InterfaceNATDynamicRulesRouterPolicy

        77
      • 3.1.5.9 DeviceNATTimeoutsRouterPolicy

        79
      • 3.1.5.10 InterfaceNATAddressPoolFirewallPolicy

        81
      • 3.1.5.11 DeviceNATTransOptionsFirewallPolicy

        82
      • 3.1.5.12 InterfaceNATTransExemptionsFirewallPolicy

        83
      • 3.1.5.13 InterfaceNATDynamicRulesFirewallPolicy

        85
      • 3.1.5.14 InterfaceNATPolicyDynamicRulesFirewallPolicy

        87
      • 3.1.5.15 InterfaceNATStaticRulesFirewallPolicy

        90
      • 3.1.5.16 InterfaceNATManualFirewallPolicy

        93
      • 3.1.5.17 InterfaceNAT64ManualFirewallPolicy

        98
      • 3.1.5.18 InterfaceNATObjectFirewallPolicy

        99
      • 3.1.5.19 InterfaceNAT64ObjectFirewallPolicy

        102
  • 3.2 Methods

    103
    • 3.2.1 Method GetServiceInfo

      104
      • 3.2.1.1 Request

        104
      • 3.2.1.2 Response

        105
    • 3.2.2 Method GetGroupList

      106
      • 3.2.2.1 Request

        106
      • 3.2.2.2 Response

        107
    • 3.2.3 Method GetDeviceListByCapability

      110
      • 3.2.3.1 Request

        110
      • 3.2.3.2 Response

        111
    • 3.2.4 Method GetDeviceListByGroup

      113
      • 3.2.4.1 Request

        113
      • 3.2.4.2 Response

        114
    • 3.2.5 Method GetDeviceConfigByGID

      115
      • 3.2.5.1 Request

        115
      • 3.2.5.2 Response

        116
    • 3.2.6 Method GetDeviceConfigByName

      118
      • 3.2.6.1 Request

        118
      • 3.2.6.2 Response

        120
    • 3.2.7 Method GetPolicyListByDeviceGID

      121
      • 3.2.7.1 Request

        121
      • 3.2.7.2 Response

        123
    • 3.2.8 Method GetPolicyConfigByName

      124
      • 3.2.8.1 Request

        124
      • 3.2.8.2 Response

        126
    • 3.2.9 Method GetPolicyConfigByDeviceGID

      129
      • 3.2.9.1 Request

        129
      • 3.2.9.2 Response

        130
    • 3.2.10 Method GetSharedPolicyNamesByType

      130
      • 3.2.10.1 REST Request:

        130
      • 3.2.10.2 Response Object:

        132
• 4 CSM Events Service API

  134
  • 4.1 Methods

    134
    • 4.1.1 Method GetServiceInfo

      134
    • 4.1.2 Method EventSubcription

      134
      • 4.1.2.1 Request

        134
      • 4.1.2.2 Response

        137
      • 4.1.2.3 Syslog XML Event Notifications

        140
      • 4.1.2.4 Syslog PlainText Event Notifications

        145
• 5 CSM Utility Service API

  146
  • 5.1 Object Model

    146
  • 5.2 Methods

    146
    • 5.2.1 Method GetServiceInfo

      147
    • 5.2.2 Method execDeviceReadOnlyCLICmds

      148
      • 5.2.2.1 Request

        148
      • 5.2.2.2 Response

        150
• 6 API Scaling

  153
• 7 CSM Client Protocol State Machine

  154
  • 7.1.1 Overview

    154
  • 7.1.2 Using the configuration and event service

    156
• 8 Sample API Client Programs

  158
  • 8.1 CSM API pre-configuration checks

    159
  • 8.2 Login and ping test

    162
  • 8.3 Fetch CLI configuration of a firewall

    165
  • 8.4 Executing show access-list on a firewall device

    169
  • 8.5 Fetch CSM defined firewall policy

    173
  • 8.6 List shared policies assigned to all devices

    176
  • 8.7 List content of a given shared policy

    182
  • 8.8 Subscribing to change notifications – Deployment, OOB

    186
• 9 Troubleshooting (Common Scenarios)

  190
• 10 XML Schema

  191
  • 10.1 Common XSD

    191
  • 10.2 Config XSD

    195
  • 10.3 Event XSD

    214
  • 10.4 Utility XSD

    216