Exporting SEPM firewall policy rules in an easy to read format

Products

• Endpoint Protection

Issue/Introduction

You need to generate a list of firewall rules in a SEPM firewall policy in an easy to read text format that's easily searchable.

Environment

Symantec Endpoint Protection Manager 14.3.x

Resolution

The SEPM Rest API has functionality to export a firewall policy in an easy to read format.  Below is an outline of the steps to follow.

*Note: These steps provide the Rest API method that can be used to generate this information.  These Rest APIs can be executed using PowerShell, CURL, Bruno or any other preferred application for executing APIs.

Authenticate to a token

Use this API to generate a token

/api/v1/identity/authenticate

Body
{
  "username":"<user>",
  "password":"<password>",
  "domain":""
}

Get the Firewall policy id

You'll first need to get the {id} of the firewall policy you want to export.  To get firewall policy id's, run this API

/api/v1/policies/summary/fw

This will return a JSON response which contains details of all your Firewall policies.  Find the "name": that aligns with the policy you want to export, then a few lines down from the name you'll see the "id": .  Note this id, you'll need it for the next step

Get the Firewall policy details

Using the "id" above, execute this API.

/api/v1/policies/firewall/{id} 

Replace {id} with the "id" captured from the previous step.  No quotes, no brackets, only the id after the /firewall/

The Response will be a JSON formatted list of your firewall policy rules.

Additional Information

Symantec Endpoint Protection Manager API documents