Ansible REST API - Interacting with Cisco FirePower Management Center (FMC) - 01 - Introduction

Ansible is a very good tool for Network Automation. It has a lot of build-in modules for different vendor systems such as Cisco, Juniper & AWS.

However, besides of these vendor specified modules, we can utilise the "uri" module in Ansible to make different REST Calls. As long as the remote system supports REST API, we can write Ansible scripts to interact with them.

In the following POST series, I will use my Ansible script for Cisco FirePower Management Center (FMC) as an example to describe how Ansible's REST script works.

Cisco FirePower is a very good & widely used next-Gen firewall. Especially in the enterprise environment. However, comparing to the old Cisco ASA firwall, Cisco FirePower doesn't have the time-based ACL. So it's impossible for us to apply some time-based access rules in Cisco FMC.

But Cisco FMC does supports REST API. So we can use Ansible Script to talk to FMC and automate the policy enable/disable process and work congestion with Linux CRON job to provide policy schedule functions.

You can download my playbooks from my github repo:

https://github.com/dennisjian/Ansible-with-Cisco-FMC-API

Here are the table of content of this Ansible Cisco FMC REST API series:

1. Introduction and Ansible playbook download
2. Script flow charts
3. Introduction of REST API and Cisco FMC API Explorer
4. Script prerequisites
5. Request Access Token 
6. Get policy content, modify content and "PUT' in FMC - Part 1
7. Get policy content, modify content and "PUT' in FMC - Part 2 
8. Get deployable devices and deploy policy

In the following post (02 - Flow Charts of the scripts), I will show you the flow chart of the scripts.

LInux 101 - Enable SSH key based authentication

SSH Key based authentication allows a user to login to the remote Linux server without providing the username/password. Key based authentication works with a pair of public/private keys. The public key of the client is stored in ~/.ssh/authorized_keys on the server. The private key is kept in the client machine.

The following are the steps of authentication process:

a. User starts the SSH process by specifying key pair to be used. Then the client machine sends the SSH connection request to the server with the Key ID.

b. The server checks its ~/.ssh/authorized_keys and try to find the public key with the Key ID. Once the Key is found, the server will generate a random number and encrypts this number with the found public key.

c. The client machine decrypts the message sent by the server with its private key and obtain the random number.

d. The client machine will calculate a MD5 hash value with the "obtained random number + the session key" and send this MD5 value back to server.

(Noted: this "obtained random number + the session key" value will also be used to encrypt the communication messages between client and server later on.)

e. The server will calculate the MD5 value of "obtained random number + the session key" and compare it with the one received from the client. If they are matching, the SSH request is granted.

The follow will describe the steps of configuring the SSH key based authentication:
Step 1: Create SSH keys on the client machine

#mkdir -p $HOME/.ssh #chmod 0700 $HOME/.ssh #cd ~/.ssh # ssh-keygen -t rsa Generating public/private rsa key pair. Enter file in which to save the key (/root/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /root/.ssh/id_rsa. Your public key has been saved in /root/.ssh/id_rsa.pub. The key fingerprint is: b3:7b:be:1a:7f:66:c9:01:ea:28:f4:36:09:ec:6e:3e root@localhost.localdomain The key's randomart image is: +--[ RSA 2048]----+ |                 | |                 | |                 | |          .      | |   .    S. .     | |    +   .o  .    | |   o o +o  . o   | |    E * .+. *    | |   +o+ .o++=     | +-----------------+

After this step, we will have the private key and public key:

$HOME/.ssh/id_rsa– private key.

$HOME/.ssh/id_rsa.pub – public key.
Step 2: Copy the public key to your remote SSH server

[root@localhost ~]# ssh-copy-id root@192.168.1.216 /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys root@192.168.1.216's password: (here is the remote SSH server login password) Number of key(s) added: 1 Now try logging into the machine, with:   "ssh 'root@192.168.1.216'" and check to make sure that only the key(s) you wanted were added.

Step 3: Initial the SSH session from the client machine by specifying the key to be used

specifc the prviate key (~/.ssh/id_rsa) to be used: ssh -i ~/.ssh/id_rsa root@192.168.1.216

SSH key based authentication is widely used. In my previous post "
Network Automation 02 - Ansible Play book for FTP server file synchronisation
", we use key based authentication for the "rsync".

Linux 101 - Setup FTP/SFTP server in Centos

1. Install vsftpd and enable the service, open the firewall port    

# yum install vsftpd # systemctl start vsftpd # systemctl enable vsftpd # firewall-cmd --zone=public --permanent --add-port=21/tcp # firewall-cmd --zone=public --permanent --add-service=ftp # firewall-cmd --reload

2. Configure the FTP server:

# cp /etc/vsftpd/vsftpd.conf /etc/vsftpd/vsftpd.conf.orig vi vsftpd.conf anonymous_enable=NO             userlist_enable=YES userlist_deny=NO                      userlist_file=/etc/vsftpd.userlist    chroot_local_user=YES allow_writeable_chroot=YES local_root=/etc/ansible/backup # the above folder needs to be existed or: local_root=/var/ftp/ansible/backup

3. Fix the SELinux for vsftpd

# setsebool -P allow_ftpd_full_access 1

4. Create user for FTP access

# useradd -m -c “dennis” -s /bin/bash dennis # passwd dennis Changing password for user dennis. New password: Retype new password: passwd: all authentication tokens updated successfully. # echo "dennis" | tee -a /etc/vsftpd.userlist # cat /etc/vsftpd.userlist

5. Create Secure FTP

# mkdir /etc/ssl/private # openssl req -x509 -nodes -keyout /etc/ssl/private/vsftpd.pem -out /etc/ssl/private/vsftpd.pem -days 365 -newkey rsa:2048 Country Name (2 letter code) [XX]:IN State or Province Name (full name) []:Lower Parel Locality Name (eg, city) [Default City]:Mumbai Organization Name (eg, company) [Default Company Ltd]:TecMint.com Organizational Unit Name (eg, section) []:Linux and Open Source Common Name (eg, your name or your server's hostname) []:tecmint Email Address []:admin@tecmint.com # firewall-cmd --zone=public --permanent --add-port=990/tcp # firewall-cmd --zone=public --permanent --add-port=40000-50000/tcp # firewall-cmd --reload # vi /etc/vsftpd/vsftpd.conf ssl_enable=YES ssl_tlsv1_2=YES ssl_sslv2=NO ssl_sslv3=NO rsa_cert_file=/etc/ssl/private/vsftpd.pem rsa_private_key_file=/etc/ssl/private/vsftpd.pem allow_anon_ssl=NO force_local_data_ssl=YES force_local_logins_ssl=YES require_ssl_reuse=NO ssl_ciphers=HIGH pasv_min_port=40000 pasv_max_port=50000 debug_ssl=YES # systemctl restart vsftpd