-
Notifications
You must be signed in to change notification settings - Fork 1
/
removetemplate_nodelete.py
669 lines (525 loc) · 28.3 KB
/
removetemplate_nodelete.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
# NOTE: THIS SCRIPT IS UNFINISHED. CHECK BACK FOR UPDATES
#
# This is a script to convert networks configured as template-based to indivudually managed networks without templates.
# At this stage the script is limited to MX-only networks.
#
# Usage:
# python removetemplate.py -k <key> -o <org> [-a <admin privilege> -f <filter tag> -b <base net>]
#
# Mandatory arguments:
# -k <key> Your Meraki Dashboard API key
# -o <org> The name of the organization you want to modify
#
# Optional arguments:
# -a <admin privilege> Maximum privilege level for copied network administrators. Valid options:
# full Administators copied can have up to full admin privileges
# read-only Full network admins will be limited to read-only in the new net (default)
# -f <filter tag> Only process networks tagged <filter tag>
# -b <base net> Name of network that will be used as clone source to create the new networks. The
# base net will contain IPS, AMP, NAT, Content filtering and Traffic shaping settings. The base
# net needs to be type 'appliance' and NOT bound to a template
#
# Example, process all MX networks tagged "convertme" in org "Meraki Inc", using base net named "clone_source":
# python removetemplate.py -k 1234 -o "Meraki Inc" -b clone_source -f convertme
#
# Use double quotes ("") in Windows to pass arguments containing spaces. Names are case-sensitive.
#
# The Base must have the following configuration:
# * VLANs enabled
# * All VLANs should have subnets that are NOT used in the production network
# * Although DHCP parameters can be overwritten, the DHCP run/relay/off switch cannot. If the clone source
# has VLANs predefined, have the DHCP run state configured in them the correct way. Any VLANs not present in
# the clone source net will be created as "DHCP: run server"
# * Have IPS, AMP, NAT, Content filtering and Traffic shaping settings configured
#
# This script was developed using Python 3.6.4. You will need the Requests module to run it. You can install
# the module via pip:
# pip install requests
#
# More info on this module:
# http://python-requests.org
#
# To make script chaining easier, all lines containing informational messages to the user
# start with the character @
#
# This file was last modified on 2018-05-04
import sys, getopt, requests, json, time
from datetime import datetime
#Used for time.sleep(API_EXEC_DELAY). Delay added to avoid hitting dashboard API max request rate
API_EXEC_DELAY = 0.21
#connect and read timeouts for the Requests module
REQUESTS_CONNECT_TIMEOUT = 60
REQUESTS_READ_TIMEOUT = 60
#used by merakirequestthrottler(). DO NOT MODIFY
LAST_MERAKI_REQUEST = datetime.now()
def printusertext(p_message):
#prints a line of text that is meant for the user to read
#do not process these lines when chaining scripts
print('@ %s' % p_message)
def printhelp():
#prints help text
printusertext('This is a script to convert networks configured as template-based to indivudually managed networks without templates.')
printusertext('At this stage the script is limited to MX-only networks.')
printusertext('')
printusertext('Usage:')
printusertext(' python removetemplate.py -k <key> -o <org> [-a <admin privilege> -f <filter tag> -b <base net>]')
printusertext('')
printusertext('Mandatory arguments:')
printusertext(' -k <key> Your Meraki Dashboard API key')
printusertext(' -o <org> The name of the organization you want to modify')
printusertext('')
printusertext('Optional arguments:')
printusertext(' -a <admin privilege> Maximum privilege level for copied network administrators. Valid options:')
printusertext(' full Administators copied can have up to full admin privileges')
printusertext(' read-only Full network admins will be limited to read-only in the new net (default)')
printusertext(' -f <filter tag> Only process networks tagged <filter tag>')
printusertext(' -b <base net> Name of network that will be used as clone source to create the new networks. The')
printusertext(' base net will contain IPS, AMP, NAT, Content filtering and Traffic shaping settings.')
printusertext(' The base net needs to be type "appliance" and NOT bound to a template')
printusertext('')
printusertext('Example, process all MX networks tagged "convertme" in org "Meraki Inc", using base net named "clone_source":')
printusertext(' python removetemplate.py -k 1234 -o "Meraki Inc" -b clone_source -f convertme')
printusertext('')
printusertext('Use double quotes ("") in Windows to pass arguments containing spaces. Names are case-sensitive.')
def merakirequestthrottler():
#makes sure there is enough time between API requests to Dashboard to avoid hitting shaper
global LAST_MERAKI_REQUEST
if (datetime.now()-LAST_MERAKI_REQUEST).total_seconds() < API_EXEC_DELAY:
time.sleep(API_EXEC_DELAY)
LAST_MERAKI_REQUEST = datetime.now()
return
def getorgid(p_apikey, p_orgname):
#looks up org id for a specific org name
#on failure returns 'null'
merakirequestthrottler()
r = requests.get('https://api.meraki.com/api/v0/organizations', headers={'X-Cisco-Meraki-API-Key': p_apikey, 'Content-Type': 'application/json'}, timeout=(REQUESTS_CONNECT_TIMEOUT, REQUESTS_READ_TIMEOUT))
if r.status_code != requests.codes.ok:
return (None)
rjson = r.json()
for record in rjson:
if record['name'] == p_orgname:
return record['id']
return (None)
def getshard(p_apikey, p_orgid):
#Looks up shard FQDN host for a specific org. Use this URL instead of 'dashboard.meraki.com'
# when making API calls with API accounts that can access multiple orgs.
#On failure returns 'null'
merakirequestthrottler()
r = requests.get('https://api.meraki.com/api/v0/organizations/%s/snmp' % p_orgid, headers={'X-Cisco-Meraki-API-Key': p_apikey, 'Content-Type': 'application/json'}, timeout=(REQUESTS_CONNECT_TIMEOUT, REQUESTS_READ_TIMEOUT))
if r.status_code != requests.codes.ok:
return (None)
rjson = r.json()
return(rjson['hostname'])
def gettemplates(p_apikey, p_orgid, p_shardhost):
#returns the list of configuration templates for a specified organization
merakirequestthrottler()
r = requests.get('https://%s/api/v0/organizations/%s/configTemplates' % (p_shardhost, p_orgid), headers={'X-Cisco-Meraki-API-Key': p_apikey, 'Content-Type': 'application/json'}, timeout=(REQUESTS_CONNECT_TIMEOUT, REQUESTS_READ_TIMEOUT))
if r.status_code != requests.codes.ok:
return (None)
rjson = r.json()
return(rjson)
def getnetworks(p_apikey, p_orgid, p_shardhost):
#returns the list of networks for a specified organization
merakirequestthrottler()
r = requests.get('https://%s/api/v0/organizations/%s/networks' % (p_shardhost, p_orgid), headers={'X-Cisco-Meraki-API-Key': p_apikey, 'Content-Type': 'application/json'}, timeout=(REQUESTS_CONNECT_TIMEOUT, REQUESTS_READ_TIMEOUT))
if r.status_code != requests.codes.ok:
return (None)
rjson = r.json()
return(rjson)
def createnet(p_apikey, p_orgid, p_shardurl, p_name, p_basenetid = None, p_nettags = None):
#creates a network into an organization, either by cloning an existing one, or by cloning
merakirequestthrottler()
if p_basenetid is None:
payload = json.dumps({'name':p_name, 'type':'appliance', 'tags':'removetemplate-py'})
else:
if p_nettags is None:
payload = json.dumps({'name':p_name, 'type':'appliance', 'copyFromNetworkId': p_basenetid})
else:
payload = json.dumps({'name':p_name, 'type':'appliance', 'tags':p_nettags, 'copyFromNetworkId': p_basenetid})
r = requests.post('https://%s/api/v0/organizations/%s/networks' % (p_shardurl, p_orgid), data=payload, headers={'X-Cisco-Meraki-API-Key': p_apikey, 'Content-Type': 'application/json'}, timeout=(REQUESTS_CONNECT_TIMEOUT, REQUESTS_READ_TIMEOUT))
if 200 <= r.status_code < 300:
rjson = r.json()
return (rjson)
return(None)
def deletenet(p_apikey, p_netid, p_shardhost):
#returns the list of networks for a specified organization
merakirequestthrottler()
r = requests.delete('https://%s/api/v0/networks/%s' % (p_shardhost, p_netid), headers={'X-Cisco-Meraki-API-Key': p_apikey, 'Content-Type': 'application/json'}, timeout=(REQUESTS_CONNECT_TIMEOUT, REQUESTS_READ_TIMEOUT))
if 200 <= r.status_code < 300:
return ('ok')
return(None)
def getvlans(p_apikey, p_netid, p_shardhost):
#returns the list of VLANs for a network
merakirequestthrottler()
r = requests.get('https://%s/api/v0/networks/%s/vlans' % (p_shardhost, p_netid), headers={'X-Cisco-Meraki-API-Key': p_apikey, 'Content-Type': 'application/json'}, timeout=(REQUESTS_CONNECT_TIMEOUT, REQUESTS_READ_TIMEOUT))
if r.status_code != requests.codes.ok:
return (None)
rjson = r.json()
return(rjson)
def createvlan(p_apikey, p_netid, p_shardurl, p_attributes):
#creates a MX VLAN into a network
merakirequestthrottler()
r = requests.post('https://%s/api/v0/networks/%s/vlans' % (p_shardurl, p_netid), data=json.dumps(p_attributes), headers={'X-Cisco-Meraki-API-Key': p_apikey, 'Content-Type': 'application/json'}, timeout=(REQUESTS_CONNECT_TIMEOUT, REQUESTS_READ_TIMEOUT))
if 200 <= r.status_code < 300:
rjson = r.json()
return ('ok')
return(None)
def updatevlan(p_apikey, p_netid, p_shardurl, p_attributes):
#update an existing MX VLAN
merakirequestthrottler()
r = requests.put('https://%s/api/v0/networks/%s/vlans/%s' % (p_shardurl, p_netid, p_attributes['id']), data=json.dumps(p_attributes), headers={'X-Cisco-Meraki-API-Key': p_apikey, 'Content-Type': 'application/json'}, timeout=(REQUESTS_CONNECT_TIMEOUT, REQUESTS_READ_TIMEOUT))
if 200 <= r.status_code < 300:
rjson = r.json()
return ('ok')
return(None)
def deletevlan(p_apikey, p_netid, p_shardurl, p_vlanid):
#delete an existing MX VLAN
merakirequestthrottler()
r = requests.delete('https://%s/api/v0/networks/%s/vlans/%s' % (p_shardurl, p_netid, p_vlanid), headers={'X-Cisco-Meraki-API-Key': p_apikey, 'Content-Type': 'application/json'}, timeout=(REQUESTS_CONNECT_TIMEOUT, REQUESTS_READ_TIMEOUT))
return(None)
def readmxfwruleset(p_apikey, p_shardhost, p_nwid):
#return the MX L3 firewall ruleset for a network
merakirequestthrottler()
r = requests.get('https://%s/api/v0/networks/%s/l3FirewallRules' % (p_shardhost, p_nwid), headers={'X-Cisco-Meraki-API-Key': p_apikey, 'Content-Type': 'application/json'}, timeout=(REQUESTS_CONNECT_TIMEOUT, REQUESTS_READ_TIMEOUT))
if r.status_code != requests.codes.ok:
return None
rjson = r.json()
return(rjson)
def writemxfwruleset(p_apikey, p_shardhost, p_nwid, p_ruleset):
#writes MX L3 ruleset for a device to cloud
merakirequestthrottler()
r = requests.put('https://%s/api/v0/networks/%s/l3FirewallRules/' % (p_shardhost, p_nwid), data=json.dumps({'rules': p_ruleset}), headers={'X-Cisco-Meraki-API-Key': p_apikey, 'Content-Type': 'application/json'}, timeout=(REQUESTS_CONNECT_TIMEOUT, REQUESTS_READ_TIMEOUT))
if r.status_code != requests.codes.ok:
return None
return('ok')
def getorgadmins(p_apikey, p_orgid, p_shardhost):
#returns the list of admins for a specified organization
merakirequestthrottler()
r = requests.get('https://%s/api/v0/organizations/%s/admins' % (p_shardhost, p_orgid), headers={'X-Cisco-Meraki-API-Key': p_apikey, 'Content-Type': 'application/json'}, timeout=(REQUESTS_CONNECT_TIMEOUT, REQUESTS_READ_TIMEOUT))
if r.status_code != requests.codes.ok:
return (None)
rjson = r.json()
return(rjson)
def updateorgadmin(p_apikey, p_orgid, p_shard, p_attributes):
#creates admin into an organization
merakirequestthrottler()
r = requests.put('https://%s/api/v0/organizations/%s/admins/%s' % (p_shard, p_orgid, p_attributes['id']), data=json.dumps(p_attributes), headers={'X-Cisco-Meraki-API-Key': p_apikey, 'Content-Type': 'application/json'}, timeout=(REQUESTS_CONNECT_TIMEOUT, REQUESTS_READ_TIMEOUT))
if r.status_code != requests.codes.ok:
return None
return('ok')
def stripdefaultrule(p_inputruleset):
#strips the default allow ending rule from an MX L3 Firewall ruleset
outputset = []
if len(p_inputruleset) > 0:
lastline = p_inputruleset[len(p_inputruleset)-1]
if lastline == {'protocol': 'Any', 'policy': 'allow', 'comment': 'Default rule', 'srcCidr': 'Any', 'srcPort': 'Any', 'syslogEnabled': False, 'destPort': 'Any', 'destCidr': 'Any'}:
outputset = p_inputruleset[:-1]
else:
outputset = p_inputruleset
return(outputset)
def main(argv):
# python removetemplate.py -k <key> -o <org> [-a <admin privilege> -f <filter tag> -b <base net>]
#initialize variables for command line arguments
arg_apikey = ''
arg_orgname = ''
arg_adminlvl = ''
arg_filter = ''
arg_basenet = ''
#get command line arguments
try:
opts, args = getopt.getopt(argv, 'hk:o:a:f:b:')
except getopt.GetoptError:
printhelp()
sys.exit(2)
for opt, arg in opts:
if opt == '-h':
printhelp()
sys.exit()
elif opt == '-k':
arg_apikey = arg
elif opt == '-o':
arg_orgname = arg
elif opt == '-a':
arg_adminlvl = arg
elif opt == '-f':
arg_filter = arg
elif opt == '-b':
arg_basenet = arg
#check that all mandatory arguments have been given
if arg_apikey == '' or arg_orgname == '':
printhelp()
sys.exit(2)
if not arg_adminlvl in ['full', 'read-only', '']:
printusertext('ERROR 01: Max admin privilege must be "full" or "read-only"')
sys.exit(2)
#set optional parameters with no given values to defaults
if arg_adminlvl == '':
arg_adminlvl = 'read-only'
#arg_basenet == '' means not specified
#arg_filter == '' means not specified
#get orgid and shard host
try:
orgid = getorgid(arg_apikey, arg_orgname)
except:
printusertext('ERROR 02: Unable to contact Meraki cloud')
sys.exit(2)
if orgid is None:
printusertext('ERROR 03: Unable to find org "%s"' % arg_orgname)
sys.exit(2)
try:
shard = getshard(arg_apikey, orgid)
except:
printusertext('ERROR 04: Unable to contact Meraki cloud')
sys.exit(2)
if shard is None:
printusertext('ERROR 05: Unable to resolve shard for org "%s"' % arg_orgname)
sys.exit(2)
#get list of networks
#network fields: {'id', 'organizationId', 'name', 'timeZone', ('tags'), 'type', ('configTemplateId')}
try:
networklist = getnetworks(arg_apikey, orgid, shard)
except:
printusertext('ERROR 06: Unable to contact Meraki cloud')
sys.exit(2)
if networklist is None:
printusertext('ERROR 07: Org "%s" contains no networks' % arg_orgname)
sys.exit(2)
cleannetlist = []
for network in networklist:
if 'configTemplateId' in network:
#if user gave net tag filter, make sure tag exists in net
flag_infilterscope = True
if arg_filter != '':
if network['tags'] is None:
flag_infilterscope = False
elif network['tags'].find(arg_filter) == -1:
flag_infilterscope = False
if flag_infilterscope:
if network['type'] != 'combined' and network['type'].find('appliance') == -1:
printusertext('WARNING: Skipping net "%s": Must be type "combined" or "appliance"' % network['name'])
else:
cleannetlist.append(network)
else:
printusertext('WARNING: Skipping net "%s": Not in filter scope' % network['name'])
else:
printusertext('WARNING: Skipping net "%s": Not bound to a template' % network['name'])
#check if user has given a base net name and resolve it if needed
NEW_NET_ADDED_TAGS = 'removetemplate-py'
basenetid = None
basetags = None
if arg_basenet != '':
for network in networklist:
if network['name'] == arg_basenet:
basenetid = network['id']
if 'configTemplateId' in network:
printusertext('ERROR 08: Base net "%s" must not be bound to a template' % arg_basenet)
sys.exit(2)
if network['type'] != 'appliance':
printusertext('ERROR 09: Base net "%s" must be type "appliance", not "%s"' % (arg_basenet, network['type']))
sys.exit(2)
if network['tags'] is None:
basetags = NEW_NET_ADDED_TAGS
else:
basetags = network['tags'] + ' ' + NEW_NET_ADDED_TAGS
break
if basenetid is None:
printusertext('ERROR 10: Unable to find network with name "%s"' % arg_basenet)
sys.exit(2)
#Get list of org admins. Will be used later
orgadmins = getorgadmins(arg_apikey, orgid, shard)
for network in cleannetlist:
printusertext('INFO: Processing net "%s"' % network['name'])
#create new network
#find an unused network name
MAX_NETWORK_RENAME_TRIES = 99 #needs to be 1 or more
newname = network['name'] + ' - new'
newnamemod = newname
flag_nametaken = False
for i in range(0, MAX_NETWORK_RENAME_TRIES):
flag_nametaken = False
if i != 0:
newnamemod = newname + str(i)
for rawnet in networklist:
if rawnet['name'] == newnamemod:
flag_nametaken = True
break
if not flag_nametaken:
break
if i == MAX_NETWORK_RENAME_TRIES:
printusertext('ERROR 11: Unable to create new net name for "%s"' % network['name'])
sys.exit(2)
#create the network, with cloning if possible
try:
returnmsg = createnet(arg_apikey, orgid, shard, newnamemod, basenetid, basetags)
except:
printusertext('ERROR 12: Unable to contact Meraki cloud')
sys.exit(2)
if returnmsg is None:
printusertext('ERROR 13: Unable to create new net for "%s"' % network['name'])
sys.exit(2)
newnetid = returnmsg['id']
#Standard VLAN assignment
#NOTE: Reading/writing VLAN group policies via API is not supported right now
netvlans = getvlans(arg_apikey, network['id'], shard)
#if VLANs, attempt conversion
if not netvlans is None:
printusertext('INFO: Copying VLANs...')
#check to see if VLANs are enabled in new net
try:
newvlans = getvlans(arg_apikey, newnetid, shard)
except:
printusertext('ERROR 14: Unable to contact Meraki cloud')
deletenet(arg_apikey, newnetid, shard)
sys.exit(2)
if newvlans is None:
printusertext('ERROR 15: Use a base net with VLANs enabled to convert net "%s"' % network['name'])
deletenet(arg_apikey, newnetid, shard)
sys.exit(2)
#compare netvlans and newvlans for find which will need to be added, modified, removed in new net
addvlans = []
delvlans = []
modvlans = []
#check which vlans will need to be added/modified
for vlan in netvlans:
flag_vlannotfound = True
for tempvlan in newvlans:
if vlan['id'] == tempvlan['id']:
modvlans.append(vlan)
flag_vlannotfound = False
break
if flag_vlannotfound:
addvlans.append(vlan)
#check which vlans will need to be removed from the template
for tvlan in newvlans:
flag_vlannotfound = True
for mvlan in modvlans:
if tvlan['id'] == mvlan['id']:
flag_vlannotfound = False
break
if flag_vlannotfound:
delvlans.append(tvlan)
#process VLANs
flag_deletepending = True
if len(modvlans) > 1:
for vlan in delvlans:
try:
deletevlan(arg_apikey, newnetid, shard, vlan['id'])
except:
printusertext('ERROR 16: Unable to remove source net VLAN "%s"' % vlan['id'])
deletenet(arg_apikey, newnetid, shard)
sys.exit(2)
flag_deletepending = False
for vlan in modvlans:
try:
retvalue = updatevlan(arg_apikey, newnetid, shard, vlan)
except:
printusertext('ERROR 17: Unable to modify source net VLAN "%s"' % vlan['id'])
deletenet(arg_apikey, newnetid, shard)
sys.exit(2)
if flag_deletepending:
for vlan in delvlans:
try:
deletevlan(arg_apikey, newnetid, shard, vlan['id'])
except:
printusertext('ERROR 18: Unable to remove source net VLAN "%s"' % vlan['id'])
deletenet(arg_apikey, newnetid, shard)
sys.exit(2)
for vlan in addvlans:
try:
createvlan(arg_apikey, newnetid, shard, vlan)
except:
printusertext('ERROR 19: Unable to create VLAN "%s" for net "%s"' % (vlan['id'], newnamemod))
deletenet(arg_apikey, newnetid, shard)
sys.exit(2)
#verify VLANs
printusertext('INFO: Verifying VLANs...')
try:
finalvlans = getvlans(arg_apikey, newnetid, shard)
except:
printusertext('ERROR 20: Unable to verify VLANs for net "%s"' % newnamemod)
deletenet(arg_apikey, newnetid, shard)
sys.exit(2)
for srcvlan in netvlans:
flag_nomatchfound = True
for finvlan in finalvlans:
#DEBUG
print ('DEBUG: Checking source %s vs final %s' % (srcvlan['id'], finvlan['id']))
if srcvlan['id'] == finvlan['id']:
flag_allvaluesmatch = True
for label in srcvlan:
#DEBUG
print ('DEBUG: Checking label %s' % label)
if label != 'networkId':
if srcvlan[label] != finvlan[label]:
#DEBUG
print ('DEBUG: Check failed')
flag_allvaluesmatch = False
break
else:
#DEBUG
print ('DEBUG: Check passed')
if flag_allvaluesmatch:
flag_nomatchfound = False
break
if flag_nomatchfound:
#DEBUG
printusertext('WARNING: VLAN "%s" verification failed for net "%s"' % (srcvlan['id'], newnamemod))
#DEBUG
#deletenet(arg_apikey, newnetid, shard)
#sys.exit(2)
#endif not netvlans is None
#Process firewall rules
printusertext('INFO: Copying firewall rules...')
try:
netrules = readmxfwruleset(arg_apikey, shard, network['id'])
except:
printusertext('ERROR 22: Unable to read firewall rules for net "%s"' % network['name'])
deletenet(arg_apikey, newnetid, shard)
sys.exit(2)
if netrules is None:
printusertext('ERROR 23: Unable to read firewall rules for net "%s"' % network['name'])
deletenet(arg_apikey, newnetid, shard)
sys.exit(2)
striprules = stripdefaultrule(netrules)
if len(striprules) > 0:
try:
writemxfwruleset(arg_apikey, shard, newnetid, striprules)
except:
printusertext('ERROR 24: Unable to write firewall rules for net "%s"' % newnamemod)
deletenet(arg_apikey, newnetid, shard)
sys.exit(2)
#verify firewall rules
try:
newrules = readmxfwruleset(arg_apikey, shard, newnetid)
except:
printusertext('ERROR 25: Unable to read firewall rules for net "%s"' % newnamemod)
deletenet(arg_apikey, newnetid, shard)
sys.exit(2)
if netrules != newrules:
printusertext('ERROR 26: Firewall rules\' verification failed for net "%s"' % newnamemod)
deletenet(arg_apikey, newnetid, shard)
sys.exit(2)
#end section: Firewall rules
#Network Admin access + privileges
printusertext('INFO: Setting net admin access...')
#Go through Org admin list and find the ones that have a matching name. Transfer them to the new network
#if admin privilege is higher than the one given as a parameter, limit privilege
for admin in orgadmins:
for adnet in admin['networks']:
if adnet['id'] == network['id']:
admincopy = admin
privilege = {'id': newnetid, 'access': adnet['access']}
if arg_adminlvl == 'read-only' and adnet['access'] == 'full':
privilege['access'] = 'read-only'
admincopy['networks'].append(privilege)
try:
retvalue = updateorgadmin(arg_apikey, orgid, shard, admincopy)
except:
printusertext('ERROR 27: Unable update privileges for admin "%s"' % admincopy['email'])
deletenet(arg_apikey, newnetid, shard)
sys.exit(2)
if retvalue is None:
printusertext('WARNING: Unable to update admin "%s" (Conflicting privileges?)' % admincopy['email'])
#TODO: move devices
if __name__ == '__main__':
main(sys.argv[1:])