Adding a data center object (Cisco NDO/APIC EPG) to a Checkpoint's network group object

[pdn]

Hi,

I need your prompt help and feedbacks, please.

We've developed a software application that touches both Cisco NDO/APIC and Checkpoint.  So far, I've found integration between Cisco NDO/APIC and Checkpoint really challenging, frustrating to be honest.  

Particularly, regarding the associating a NDO/APIC's data center object to Checkpoint's network group.  This is all REST API calls.  After creating the DC object (an EPG) in NDO/APIC, I would need to associate the EPG to an existing Checkpoint's network group.  So, I used add-data-center-object and publish WAPI calls.

The association works at times, but failed other times.  In particular, I do see the EPG DC object created on Checkpoint, but it's not associated to the existing network group at times.  I don't even see the logs on Checkpoint that the DC object was created, network group is modified and the publish step, like the picture below which shows a successful DC object create and successful association.  I even introduced few-second delay between DC object create (on the Checkpoint) and the publish, but not helping to address issue 100%.

Why this happens?  If you run into the same issue, please share how to address it.  Appreciate your feedbacks and help!

Is there a WAPI API call that allows me to update (ie, add) an existing network group with a DC object?  I can't see such API exists from the Management API Reference documentation.  If it exists, I like to implement a check logic into my code, like below:

add-data-center-object

publish

While (DC_object isn't added into the Checkpoint's network group yet):

     wait(1sec)

     try to update (add the DC_object) the network group again.

     publish

     Check again, if DC_object is added to the Checkpoint's network group.

After while loop is exited, the DC object should now be in the network group.

Would this solution help address my association issue?

[G_W_Albrecht]

Why not contact the local CP SE and/or TAC for help?

[pdn]

I was thinking about that, but thought this channel would also be of help.  I am sure there are people who have NDO/APIC & Checkpoint integration experience here.

Anything feedback is appreciated.

[the_rock]

Example at the bottom maybe?

Andy

https://sc1.checkpoint.com/documents/latest/APIs/#cli/add-data-center-object~v1.9%20

[pdn]

As mentioned in my problem statement, I already used add-data-center-object. 

So I used add-data-center-object API call to create an DC object.  In the body, I have the network group name in the request body like below:

url = f"{cp_url}/add-data-center-object"

body = {"data-center-uid": “abc”,
"uid-in-data-center": “xyz”,
"groups”: [“CP_network_group”]}

response = self.session.post(url, json=body, verify=self.verify)

[PhoneBoy · Accepted solution]

The publish action is not synchronous and returns a task-id.
You will need to monitor this task-id to confirm when the publish action completes.
Only then will the changes be effective.

[pdn]

Is show-task the right WAPI call to check for the publish task status?

https://sc1.checkpoint.com/documents/latest/APIs/#web/show-task~v1.8%20

I guess I can do a loop that checks for its status, before continuing on.  If not done, I can delay 1, and check again.  

[pdn]

Mr. PhoneBoy, your hint was very helpful!   I went back, added more code, checks, and now it is working 100%. 

Thank you so much!