Description

The addManualNatRule operation handles configuration related to ManualNatRule model. 
This API call is not allowed on the standby unit in an HA pair.

HTTP request

POST /api/fdm/v6/policy/manualnatpolicies/{parentId}/manualnatrules

Data Parameters

Parameter Required Type Description
name True string A string containing the name of the ManualNatRule object
description False string An optional string that describes the rule
Field level constraints: must match pattern ^((?!;).)*$. (Note: Additional constraints might exist)
sourceInterface False object
Allowed types are: [EtherChannelInterface, PhysicalInterface, SubInterface, VirtualTunnelInterface, VlanInterface]
destinationInterface False object
Allowed types are: [EtherChannelInterface, PhysicalInterface, SubInterface, VirtualTunnelInterface, VlanInterface]
natType True string
Field level constraints: cannot be null. (Note: Additional constraints might exist)
patOptions False object
netToNet False boolean
noProxyArp False boolean
dns False boolean
interfaceIPv6 False boolean
routeLookup False boolean
enabled False boolean
interfaceInOriginalDestination False boolean A Boolean object which can be true if it's routed mode only, and translatedDestination must be null, and originalDestinationPort, translatedDestinationPort and sourceInterface fields must all not null.
interfaceInTranslatedSource False boolean For static NAT, this could be:
  • If routed mode, True with null in translatedSource, and not-null in originalSourcePort and translatedSourcePort, and destiantionInterface field cannot be null, OR,
  • False with a NetworkObject or NetworkObjectGroup reference in translatedSource
For dynamic NAT, the translatedSource field cannot be null, and to set this field to true, the firewall mode has to be routed and destinationInterface field cannot be null.
originalSource False object A NetworkObject or NetworkObjectGroup reference, or null for 'any' source address.
Allowed types are: [NetworkObject, NetworkObjectGroup]
originalDestination False object A NetworkObject or NetworkObjectGroup reference, or null for 'any' destination address.
Allowed types are: [NetworkObject, NetworkObjectGroup]
originalSourcePort False object A reference to TCPPortObject or UDPPortObject that contains single port number. Use null for 'any' port. Note, if specified, all the four port fields should all be either UDP or TCP ports. Additionally, originalSourcePort and translatedSourcePort should be either both specified (not null), or both null.
Allowed types are: [ICMPv4PortObject, ICMPv6PortObject, ProtocolObject, TCPPortObject, UDPPortObject]
originalDestinationPort False object A reference to TCPPortObject or UDPPortObject that contains single port number. Use null for 'any' port. Note, if specified, all the four port fields should all be either UDP or TCP ports. Additionally, originalDestinationPort and translatedDestinationPort should be either both specified (not null), or both null
Allowed types are: [ICMPv4PortObject, ICMPv6PortObject, ProtocolObject, TCPPortObject, UDPPortObject]
translatedSource False object A NetworkObject or NetworkObjectGroup reference, note only 'host' or 'IP range' are allowed in the object(s), no 'network' sub-type is allowed.
Allowed types are: [NetworkObject, NetworkObjectGroup]
translatedDestination False object A NetworkObject or NetworkObjectGroup reference, note only 'host' or 'IP range' are allowed in the object(s), no 'network' sub-type is allowed.
Allowed types are: [NetworkObject, NetworkObjectGroup]
translatedSourcePort False object A reference to TCPPortObject or UDPPortObject that contains single port number. Use null for 'any' port. Note, if specified, all the four port fields should all be either UDP or TCP ports. Additionally, originalSourcePort and translatedSourcePort should be either both specified (not null), or both null.
Allowed types are: [ICMPv4PortObject, ICMPv6PortObject, ProtocolObject, TCPPortObject, UDPPortObject]
translatedDestinationPort False object A reference to TCPPortObject or UDPPortObject that contains single port number. Use null for 'any' port. Note, if specified, all the four port fields should all be either UDP or TCP ports. Additionally, originalDestinationPort and translatedDestinationPort should be either both specified (not null), or both null.
Allowed types are: [ICMPv4PortObject, ICMPv6PortObject, ProtocolObject, TCPPortObject, UDPPortObject]
unidirectional False boolean A Boolean object which can be true only for static NAT rule.
rulePosition False integer Transient field holding the index position for the rule
type True string A UTF8 string, all letters lower-case, that represents the class-type. This corresponds to the class name.

Path Parameters

Parameter Required Type Description
parentId True string

Query Parameters

Parameter Required Type Description
at False integer An integer representing where to add the new object in the ordered list. Use 0 to add it at the beginning of the list. If not specified, it will be added at the end of the list

Example

curl -X POST \
    --header "Accept: application/json" \
    --header "Authorization: Bearer ${ACCESS_TOKEN}" \
    --header "Content-Type: application/json" \
    -d '{
        "description": "string",
        "destinationInterface": {
            "id": "string",
            "name": "string",
            "type": "string",
            "version": "string"
        },
        "dns": true,
        "enabled": true,
        "id": "string",
        "interfaceIPv6": true,
        "interfaceInOriginalDestination": true,
        "interfaceInTranslatedSource": true,
        "name": "string",
        "natType": "STATIC",
        "netToNet": true,
        "noProxyArp": true,
        "originalDestination": {
            "id": "string",
            "name": "string",
            "type": "string",
            "version": "string"
        },
        "originalDestinationPort": {
            "id": "string",
            "name": "string",
            "type": "string",
            "version": "string"
        },
        "originalSource": {
            "id": "string",
            "name": "string",
            "type": "string",
            "version": "string"
        },
        "originalSourcePort": {
            "id": "string",
            "name": "string",
            "type": "string",
            "version": "string"
        },
        "patOptions": {
            "extended": true,
            "flat": true,
            "includeReserve": true,
            "interfacePat": true,
            "patPoolAddress": {
                "id": "string",
                "name": "string",
                "type": "string",
                "version": "string"
            },
            "roundRobin": true,
            "type": "patoptions"
        },
        "routeLookup": true,
        "rulePosition": 0,
        "sourceInterface": {
            "id": "string",
            "name": "string",
            "type": "string",
            "version": "string"
        },
        "translatedDestination": {
            "id": "string",
            "name": "string",
            "type": "string",
            "version": "string"
        },
        "translatedDestinationPort": {
            "id": "string",
            "name": "string",
            "type": "string",
            "version": "string"
        },
        "translatedSource": {
            "id": "string",
            "name": "string",
            "type": "string",
            "version": "string"
        },
        "translatedSourcePort": {
            "id": "string",
            "name": "string",
            "type": "string",
            "version": "string"
        },
        "type": "manualnatrule",
        "unidirectional": true,
        "version": "string"
    }' \
    "https://${HOST}:${PORT}/api/fdm/v6/policy/manualnatpolicies/{parentId}/manualnatrules"
from bravado.requests_client import RequestsClient
from bravado.client import SwaggerClient


def get_client(host, token):
    http_client = RequestsClient()
    http_client.ssl_verify = False
    http_client.set_api_key(
        host,
        "Bearer {}".format(token),
        param_name="Authorization",
        param_in="header"
    )
    return SwaggerClient.from_url(
        "https://{}/apispec/ngfw.json".format(host),
        http_client=http_client,
        config={
            "validate_responses": False,
            "validate_swagger_spec": False
        }
    )


def add_manual_nat_rule(client, parent_id, body):
    return client.NAT.addManualNatRule(
        parentId=parent_id,
        body=body
    ).response().result


if __name__ == "__main__":
    host = "ftd.example.com"
    token = "access_token"
    client = get_client(host, token)

    parent_id = "string"
    body = {'description': 'string',
 'destinationInterface': {'id': 'string',
                          'name': 'string',
                          'type': 'string',
                          'version': 'string'},
 'dns': True,
 'enabled': True,
 'interfaceIPv6': True,
 'interfaceInOriginalDestination': True,
 'interfaceInTranslatedSource': True,
 'name': 'string',
 'natType': 'STATIC',
 'netToNet': True,
 'noProxyArp': True,
 'originalDestination': {'id': 'string',
                         'name': 'string',
                         'type': 'string',
                         'version': 'string'},
 'originalDestinationPort': {'id': 'string',
                             'name': 'string',
                             'type': 'string',
                             'version': 'string'},
 'originalSource': {'id': 'string',
                    'name': 'string',
                    'type': 'string',
                    'version': 'string'},
 'originalSourcePort': {'id': 'string',
                        'name': 'string',
                        'type': 'string',
                        'version': 'string'},
 'patOptions': {'extended': True,
                'flat': True,
                'includeReserve': True,
                'interfacePat': True,
                'patPoolAddress': {'id': 'string',
                                   'name': 'string',
                                   'type': 'string',
                                   'version': 'string'},
                'roundRobin': True,
                'type': 'patoptions'},
 'routeLookup': True,
 'rulePosition': 0,
 'sourceInterface': {'id': 'string',
                     'name': 'string',
                     'type': 'string',
                     'version': 'string'},
 'translatedDestination': {'id': 'string',
                           'name': 'string',
                           'type': 'string',
                           'version': 'string'},
 'translatedDestinationPort': {'id': 'string',
                               'name': 'string',
                               'type': 'string',
                               'version': 'string'},
 'translatedSource': {'id': 'string',
                      'name': 'string',
                      'type': 'string',
                      'version': 'string'},
 'translatedSourcePort': {'id': 'string',
                          'name': 'string',
                          'type': 'string',
                          'version': 'string'},
 'type': 'manualnatrule',
 'unidirectional': True}

    add_manual_nat_rule(client, parent_id, body)