Checkpoint's import of Cisco NDO/ACI objects

[pdn]

Hello,

We have Cisco NDO/ACI and Checkpoint integration.  We created some useg epg's (micro segmented epg's) in Cisco NDO with correct IP's assigned.  We have Checkpoint configured to import NDO objects into Checkpoint.  

In Checkpoint's SmartConsole, when viewing those imported useg epg's, I don't see the IP's assigned.  The weird thing, for some other useg EPG's, I do see them imported correctly into the Checkpoint with the IP's.

Does this sound like an issue with the import?  

Appreciate your prompt response.

[the_rock]

Did you use smartmove to import? I always found smartmove to work BEST with conversion from Cisco...never had that issue.

Andy

[Chris_Atkinson]

Did you review the prerequisites and limitations of the Cloudguard Controller, any potential matches there?

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_CloudGuard_Controller_AdminG... 

[pdn]

Thanks for the feedbacks The Rock and Chris.  

So, I realized that I need to use the add-data-center-object REST API call in my python script to import the useg epg ACI object into checkpoint.  The thing is, the IP associated with the useg epg isn't shown up on the CP's imported object.

I compared the good imported useg epg (that has the IP shown up.  Sometime back, not sure how it was done) to the useg epg I just imported into CP, the DynamicProperties and Ipaddr fields are set to the useg epg's IP.  Why are they blank now?

 I used the following API commands:

url = f"{url}/add-data-center-object"

body = {"data-center-uid": data_center_uid, "uid-in-data-center": object_uid, "details-level": "full"}

session.post(url, json=body)

[pdn]

Or if there is a REST API call that I can use to modify the imported epg object to include the IP afterward the import, I like to know as well.

Much thanks in advance.

[the_rock]

I totally missed this was not Cisco asa, so of course smart move would not help here. I will let @Chris_Atkinson answer.

Andy

[pdn]

Any feedback on my issue and question?

[Chris_Atkinson]

What is the scope of the issue, have you tried importing an object the traditional way unsuccessfully or is it just an issue with API usage?

Depending on where the issue is you may need to engage with TAC to diagnose it further.

[PhoneBoy · Accepted solution]

When you add a Data Center Object, it signals CloudGuard Controller to update it from the relevant Data Center.
For troubleshooting, see: https://support.checkpoint.com/results/sk/sk115657 

[pdn · Accepted solution]

I learned that the IP shows up on the Checkpoint side, only when the endpoint associated with that IP is alive and pingable.  By design.

It's not a good design, IMO.  Checkpoint should import all attributes of the useg epg, regardless if the IP is pingable or not.

[PhoneBoy]

How did you learn this?
If it was via TAC, please share the SR in a PM.

[pdn]

I discovered it via troubleshooting and testing.

[PhoneBoy]

@Gil_Sudai can you comment on this?

[Daniel_Mirkin]

CloudGuard Controller for Cisco ACI can import uSeg EPGs : 

Please refer to the Prerequisites CG Controller admin guide for R81.20 .

This behiviour is by design. Controller api requests sent to the APIC server, the response is empty in case the endpoint don't respond. 

[PhoneBoy]

Just to confirm, the "design" isn't on our end, but on the APIC server, correct?

[pdn]

I am not really sure.  I got the information from another person.  The design was agreed by both sides, some time back.