使用Python和REST API管理安全访问目标列表

简介

本文档介绍如何使用Python和REST API对目标列表执行所有可能的操作。

先决条件

Cisco 建议您了解以下主题：

1. Python
2. REST API
3. 思科安全访问

要求

在继续进行后续操作之前，必须满足以下要求：

• 具有Full Adminuser角色的Cisco Secure Access用户帐户。
• 思科安全云单一登录(SCSO)帐户登录安全访问。
• 创建您的安全访问API密钥

使用的组件

本文档中的信息基于以下软件和硬件版本：

• 安全访问控制面板
• Python 3.x

本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您的网络处于活动状态，请确保您了解所有命令的潜在影响。

配置

考虑到错误处理、令牌有效性（3600秒）等多个方面，有多种方法可以编写此代码。

在运行脚本之前，请确保已安装以下Python库：

pip install requests pip install oauthlib pip install requests_oauthlib

脚本

请确保分别在此脚本中使用API Key和Key Secret替换client_id和client_secret。

from oauthlib.oauth2 import BackendApplicationClient from oauthlib.oauth2 import TokenExpiredError from requests_oauthlib import OAuth2Session from requests.auth import HTTPBasicAuth import time import requests import pprint import json def fetch_headers(BToken): BT = f"Bearer {BToken}" headers = { 'Authorization':BT, "Content-Type": "application/json", "Accept": "application/json" } return headers # GET OAUTH 2.0 TOKEN def getToken(): token_url = 'https://api.sse.cisco.com/auth/v2/token' try: #ASSIGN your API Key to the variable client_id and Secret Key to the variable client_secret client_id = "XXXXXXXXXXXXXXXXXXXXXXXXXXXX" client_secret = "XXXXXXXXXXXXXXXXXXXXXXXXXXXX" auth = HTTPBasicAuth(client_id, client_secret) client = BackendApplicationClient(client_id=client_id) oauth = OAuth2Session(client=client) token = oauth.fetch_token(token_url=token_url, auth=auth) print("\n######Token Generated Successfully######\n") return token except e as Exception: print(f"Encountered an error while Fetching the TOKEN :: {e}") # 1 - GET DESTINATION LISTS def fetch_destinationlists(h): url = "https://api.sse.cisco.com/policies/v2/destinationlists" try: response = requests.request('GET', url, headers=h) json_object = json.loads(response.content) #pprint.pprint(json_object) x=1 for item in json_object["data"]: print(f"Destination List : {x}") pprint.pprint(f"Name : {item['name']}") pprint.pprint(f"ID : {item['id']}") #pprint.pprint(f"Destination Count : {item['meta']['destinationCount']}") print("\n") x+=1 except e as Exception: print(f"Encountered an Error while Fetching the Destination Lists :: {e}") # 2 - GET DESTINATION LIST def get_destinationlist(h): try: choice = input("Enter the ID of the DestinationList:: ") url = "https://api.sse.cisco.com/policies/v2/destinationlists/" + choice response = requests.request('GET', url, headers=h) json_object = json.loads(response.content) print("\n\n") pprint.pprint(json_object) print("\n\n") except e as Exception: print(f"Encountered an Error while Fetching the Destination List Details :: {e}") # 3 - CREATE DESTINATION LIST def create_destinationlist(h): url = "https://api.sse.cisco.com/policies/v2/destinationlists" try: naav = input("Name of the DestinationList :: ") payload = { "access": "none", "isGlobal": False, "name": naav, } response = requests.request('POST', url, headers=h, data = json.dumps(payload)) json_object = json.loads(response.content) print("\n\n") pprint.pprint(json_object) print("\n\n") except e as Exception: print(f"Encountered an Error while Creating the Destination List :: {e}") # 4 - UPDATE DESTINATION LIST NAME def patch_destinationlist(h): try: choice = input("Enter the ID of the DestinationList for changing it's name :: ") url = "https://api.sse.cisco.com/policies/v2/destinationlists/" + choice naav = input("Enter New Name :: ") payload = {"name": naav} response = requests.request('PATCH', url, headers=h, data = json.dumps(payload)) json_object = json.loads(response.content) print("\n\n") pprint.pprint(json_object) print("\n\n") except e as Exception: print(f"Encountered an Error while Updating the Destination List :: {e}") # 5 - DELETE DESTINATION LIST def delete_destinationlist(h): try: choice = input("Enter the ID of the DestinationList for DELETION :: ") url = "https://api.sse.cisco.com/policies/v2/destinationlists/" + choice response = requests.request('DELETE', url, headers=h) json_object = json.loads(response.content) print("\n\n") pprint.pprint(json_object) print("\n\n") except Exception as e: print(f"Encountered an Error while Deleting the Destination List :: {e}") # 6 - GET DESTINATIONS FROM A DESTINATION LIST def fetch_detail(h): try: choice = input("DestinationList ID: ") url2 = "https://api.sse.cisco.com/policies/v2/destinationlists/" + choice + "/destinations" response = requests.request('GET', url2, headers=h) print("\n") json_dest = json.loads(response.content) pprint.pprint(json_dest) print("\n\n") except e as Exception: print(f"Encountered an Error while Fetching the Destinations from the Destination List :: {e}") # 7 - ADD DESTINATIONS TO A DESTINATION LIST def add_destinations(h): try: choice = input("Enter the ID of the DestinationList :: ") url = "https://api.sse.cisco.com/policies/v2/destinationlists/" + choice + "/destinations" destination_to_add = input("\nEnter the destination that you want to add :: ") payload = [{"destination": destination_to_add}] response = requests.request('POST', url, headers=h, data = json.dumps(payload)) print("\n") json_dest = json.loads(response.content) pprint.pprint(json_dest) print("\n\n") except e as Exception: print(f"Encountered an Error while Adding the Destination to the Destination List :: {e}") # 8 - DELETE DESTINATIONS FROM DESTINATION LIST def delete_entry(h): try: choice_del = input("\nCONFIRM DestinationList ID from which you want to delete the Destination :: ") url3 = "https://api.sse.cisco.com/policies/v2/destinationlists/" + choice_del + "/destinations/remove" dest = int(input("ID of the Destination that you want to remove: ")) payload = f"[{dest}]" response = requests.request('DELETE', url3, headers=h, data=payload) json_del = json.loads(response.content) print("\n\n") pprint.pprint(json_del) print("\n\n") except e as Exception: print(f"Encountered an Error while Deleting a Destination from the Destination List :: {e}") #FETCH COOKIE possess_cookie = " " while possess_cookie not in ["Y","y","N","n"]: possess_cookie = input("Token Already Generated? (Y/N) :: ") if possess_cookie.upper() =="N": cook = getToken() with open("cookie.txt","w") as wr: wr.writelines(cook["access_token"]) # print(f"Access Token = {cook["access_token"]}") #FETCH HEADERS with open("cookie.txt","r") as ree: h = fetch_headers(ree.readline()) print("\n") while True: action = input("""Available operations: 1. Get Destination Lists 2. Get Destination List 3. Create Destination List 4. Update Destination List Name 5. Delete Destination List 6. Get Destinations from Destination List 7. Add Destinations to a Destination List 8. Delete Destinations from Destination List 9. Exit Enter Your Choice :: """) print("\n") operation = action.replace(" ","") if operation == "1": fetch_destinationlists(h) elif operation == "2": fetch_destinationlists(h) get_destinationlist(h) elif operation == "3": create_destinationlist(h) elif operation == "4": fetch_destinationlists(h) patch_destinationlist(h) elif operation == "5": fetch_destinationlists(h) delete_destinationlist(h) elif operation == "6": fetch_destinationlists(h) fetch_detail(h) elif operation == "7": fetch_destinationlists(h) add_destinations(h) elif operation == "8": fetch_destinationlists(h) fetch_detail(h) delete_entry(h) elif operation == "9": break else: print("\n") print("==========INCORRECT INPUT==========") print("\n") print("Thank You!!! Good Bye!!!") time.sleep(5) 

输出：

此脚本的输出必须如下所示：

Cookie Already Generated? (Y/N) :: y Available operations: 1. Get Destination Lists 2. Get Destination List 3. Create Destination List 4. Update Destination List Name 5. Delete Destination List 6. Get Destinations from Destination List 7. Add Destinations to a Destination List 8. Delete Destinations from Destination List 9. Exit Enter Your Choice :: 

Token Already Generated? (Y/N) :: y Available operations: 1. Get Destination Lists 2. Get Destination List 3. Create Destination List 4. Update Destination List Name 5. Delete Destination List 6. Get Destinations from Destination List 7. Add Destinations to a Destination List 8. Delete Destinations from Destination List 9. Exit Enter Your Choice :: 1​

成功执行此程序后，在开始的时候会提出一个关于Cookie的问题- Cookie Already Generated? (Y/N)。提出此问题的原因是确保您没有多次生成cookie，因为cookie一旦生成，其有效期为3600秒（1小时）。如果输入y或Y，则不会生成新的cookie。但是，如果您输入n或N，则会生成新的cookie，并将其保存到同一目录/文件夹中的本地文本文件中。此文件中的cookie用于后续请求。 

错误

如果为任何要求您提及目标列表ID的操作输入的ID不正确，则可能会遇到此错误：

{'message': 'no Route matched with those values'}

创建DestinationList时，如果您提到超过255个字符的DestinationList名称，则会看到以下错误：

{'code': 400, 'code_text': 'Bad Request', 'error': 'invalid_request', 'message': {'name': {'code': 'string_invalid', 'code_text': 'must be fewer than 255 characters long'}}, 'statusCode': 400, 'txId': 'l23f0cjk62fe'}

您还可以通过安全访问开发人员用户指南获取有关策略、漫游计算机、报告等的信息。

故障排除

安全访问API终端使用HTTP响应代码表示API请求成功或失败。通常，2xx范围内的代码指示成功，4xx范围内的代码指示由所提供信息导致的错误，而5xx范围内的代码指示服务器错误。解决问题的方法取决于收到的响应代码：

REST API -响应代码1

REST API -响应代码2

相关信息

• 思科安全访问用户指南
• Cisco技术支持和下载
• 添加安全访问API密钥
• 开发人员用户指南
• 配置安全访问以使用带Python的REST API
• 通过cURL管理目标列表