topic Re: Checkpoint's import of Cisco NDO/ACI objects in API / CLI Discussion

Checkpoint's import of Cisco NDO/ACI objects

pdn — Tue, 02 Jul 2024 20:28:12 GMT

Hello,

We have Cisco NDO/ACI and Checkpoint integration. We created some useg epg's (micro segmented epg's) in Cisco NDO with correct IP's assigned. We have Checkpoint configured to import NDO objects into Checkpoint.

In Checkpoint's SmartConsole, when viewing those imported useg epg's, I don't see the IP's assigned. The weird thing, for some other useg EPG's, I do see them imported correctly into the Checkpoint with the IP's.

Does this sound like an issue with the import?

Appreciate your prompt response.

Re: Checkpoint's import of Cisco NDO/ACI objects

the_rock — Tue, 02 Jul 2024 23:58:26 GMT

Did you use smartmove to import? I always found smartmove to work BEST with conversion from Cisco...never had that issue.

Andy

Re: Checkpoint's import of Cisco NDO/ACI objects

Chris_Atkinson — Wed, 03 Jul 2024 01:56:54 GMT

Did you review the prerequisites and limitations of the Cloudguard Controller, any potential matches there?

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_CloudGuard_Controller_AdminGuide/Content/Topics-CGRDG/Supported-Data-Centers-Cisco-ACI.htm?TocPath=Supported%20Data%20Centers%7CCloudGuard%20Controller%20for%20Cisco%20Application%20Centric%20Infrastructure%20(ACI)%7C_____0#CloudGuard_Controller_for_Cisco_Application_Centric_Infrastructure_(ACI)

Re: Checkpoint's import of Cisco NDO/ACI objects

pdn — Wed, 03 Jul 2024 07:01:24 GMT

Thanks for the feedbacks The Rock and Chris.

So, I realized that I need to use the add-data-center-object REST API call in my python script to import the useg epg ACI object into checkpoint. The thing is, the IP associated with the useg epg isn't shown up on the CP's imported object.

I compared the good imported useg epg (that has the IP shown up. Sometime back, not sure how it was done) to the useg epg I just imported into CP, the DynamicProperties and Ipaddr fields are set to the useg epg's IP. Why are they blank now?

I used the following API commands:

url = f"{url}/add-data-center-object"

body = {"data-center-uid": data_center_uid, "uid-in-data-center": object_uid, "details-level": "full"}

session.post(url, json=body)

Re: Checkpoint's import of Cisco NDO/ACI objects

pdn — Wed, 03 Jul 2024 19:57:41 GMT

Or if there is a REST API call that I can use to modify the imported epg object to include the IP afterward the import, I like to know as well.

Much thanks in advance.

Re: Checkpoint's import of Cisco NDO/ACI objects

the_rock — Wed, 03 Jul 2024 22:51:31 GMT

I totally missed this was not Cisco asa, so of course smart move would not help here. I will let @Chris_Atkinson answer.

Andy

Re: Checkpoint's import of Cisco NDO/ACI objects

pdn — Tue, 09 Jul 2024 03:40:20 GMT

Any feedback on my issue and question?

Re: Checkpoint's import of Cisco NDO/ACI objects

Chris_Atkinson — Tue, 09 Jul 2024 05:09:34 GMT

What is the scope of the issue, have you tried importing an object the traditional way unsuccessfully or is it just an issue with API usage?

Depending on where the issue is you may need to engage with TAC to diagnose it further.

Re: Checkpoint's import of Cisco NDO/ACI objects

PhoneBoy — Wed, 10 Jul 2024 17:15:44 GMT

When you add a Data Center Object, it signals CloudGuard Controller to update it from the relevant Data Center.
For troubleshooting, see: https://support.checkpoint.com/results/sk/sk115657

Re: Checkpoint's import of Cisco NDO/ACI objects

pdn — Wed, 10 Jul 2024 18:12:35 GMT

I learned that the IP shows up on the Checkpoint side, only when the endpoint associated with that IP is alive and pingable. By design.

It's not a good design, IMO. Checkpoint should import all attributes of the useg epg, regardless if the IP is pingable or not.

Re: Checkpoint's import of Cisco NDO/ACI objects

PhoneBoy — Thu, 11 Jul 2024 15:52:08 GMT

How did you learn this?
If it was via TAC, please share the SR in a PM.

Re: Checkpoint's import of Cisco NDO/ACI objects

pdn — Thu, 11 Jul 2024 15:53:52 GMT

I discovered it via troubleshooting and testing.

Re: Checkpoint's import of Cisco NDO/ACI objects

PhoneBoy — Thu, 11 Jul 2024 17:52:28 GMT

@Gil_Sudai can you comment on this?

Re: Checkpoint's import of Cisco NDO/ACI objects

Daniel_Mirkin — Sun, 14 Jul 2024 07:47:07 GMT

CloudGuard Controller for Cisco ACI can import uSeg EPGs :

Please refer to the Prerequisites CG Controller admin guide for R81.20 .

This behiviour is by design. Controller api requests sent to the APIC server, the response is empty in case the endpoint don't respond.

Re: Checkpoint's import of Cisco NDO/ACI objects

PhoneBoy — Mon, 15 Jul 2024 17:55:01 GMT

Just to confirm, the "design" isn't on our end, but on the APIC server, correct?

Re: Checkpoint's import of Cisco NDO/ACI objects

pdn — Mon, 15 Jul 2024 18:55:49 GMT

I am not really sure. I got the information from another person. The design was agreed by both sides, some time back.