Skip to content
Notifications
Clear all

Am I the only one who misses the simplicity of ASA ACLs?

1 Posts
1 Users
0 Reactions
6 Views
(@priya_r)
Eminent Member
Joined: 2 months ago
Posts: 13
Topic starter   [#978]

Hey folks, new to the forum and to Firepower, so please go easy on me 😅

I've been tasked with automating some security policy changes at work, moving from an old ASA to Firepower Management Center. Coming from a background where I'd script ASA ACL updates with simple SSH and `config t` commands, I'm finding the FMC REST API... a lot.

I miss being able to think in simple terms like:
```python
# Pseudo-code for what felt straightforward
acl_command = f"access-list OUTSIDE extended permit tcp any host {new_server_ip} eq 443"
ssh.send_command(acl_command)
```

Now it's a whole journey through objects, policies, and deployment. Just to add a single permit rule, I feel like I'm navigating a maze of:
* Finding the correct access policy (and its version in the API)
* Locating the specific section (pre-filter? post-filter?)
* Building a JSON payload with the correct object references for source/destination
* Handling deployment requests separately

Is this just a learning curve hump? Or does anyone else feel the raw simplicity of ASA ACLs was better for certain automation tasks? I love the data and analytics Firepower provides, but the complexity for basic changes makes me hesitate to integrate it into our CI/CD pipeline.

How are others handling this? Are there helper scripts or a certain mindset shift that made the FMC API click for you?



   
Quote