Junos SRX API interface is so easy

In this  post, I will show you some  means for  making very simple API calls using curl.


The Junos API is probably hands down, one  of  the  best API interface for  firewalls. And quickest imho to learn and pickup on.


To make a rpc call you need to know the  cmd equal. The quickest way to find this is to  execute the display xml rpc on the cli for know cli cmds. The output will be in xml and with the  corresponding  "rpc" string.



e.g { show system uptime )

kfelix@NYCMANCOURTDC> show system uptime | display xml rpc 

<rpc-reply xmlns:junos="http://xml.juniper.net/junos/15.1X49/junos">

    <rpc>

        <get-system-uptime-information>

        </get-system-uptime-information>

    </rpc>

    <cli>

        <banner></banner>

    </cli>

</rpc-reply>

Now to make a rpc call, you will use curl and call the  GET strings with the proper  rpc string. 

curl http://x.x.x.x:3000/rpc/get-system-uptime-information -u username:yourpassword 

Here's a few  working examples and with authentication, BUT 1st if your WWW basic authentication fails, you will always get a 401 message  " unauthorized "

< HTTP/1.1 401 Unauthorized

< WWW-Authenticate: Basic realm="Need basic auth header"

< Content-Type: text/html

< Content-Length: 351

< Date: Mon, 12 Nov 2018 21:41:58 GMT

< Server: lighttpd/1.4.32

 { dump the route table for a junosSRX  device  }

 

> GET /rpc/get-route-information HTTP/1.1

> Host: 10.1.1.1:3001

> Authorization: Basic a2ZlbGl50kdFVEVTQTI0MHpjYXIwMQ==

> User-Agent: curl/7.59.0

> Accept: */*

> 

< HTTP/1.1 200 OK

< Content-Type: application/xml; charset=utf-8

< Transfer-Encoding: chunked

< Date: Mon, 12 Nov 2018 21:42:17 GMT

< Server: lighttpd/1.4.32

< 

<route-information xmlns="http://xml.juniper.net/junos/15.1X49/junos-routing" xmlns:junos="http://xml.juniper.net/junos/*/junos">

<!-- keepalive -->

<route-table>

<table-name>inet.0</table-name>

<destination-count>12</destination-count>

<total-route-count>13</total-route-count>

<active-route-count>12</active-route-count>

<holddown-route-count>0</holddown-route-count>

<hidden-route-count>0</hidden-route-count>

<rt junos:style="brief">

<rt-destination>0.0.0.0/0</rt-destination>

<rt-entry>

<active-tag>*</active-tag>

<current-active/>

<last-active/>

<protocol-name>Static</protocol-name>

<preference>5</preference>

<age junos:seconds="43081">11:58:01</age>

<nh>

<selected-next-hop/>

<to>192.124.194.97</to>

<via>ge-0/0/0.0</via>

</nh>

 { dump arp table }

% curl 10.1.1.1:3001/rpc/get-arp-table-information -u kfelix

Enter host password for user 'kfelix':

<arp-table-information xmlns="http://xml.juniper.net/junos/15.1X49/junos-arp" xmlns:junos="http://xml.juniper.net/junos/*/junos" junos:style="normal">

<arp-table-entry>

<mac-address>20:fd:f1:64:ab:81</mac-address>

<ip-address>10.1.0.25</ip-address>

<hostname>10.1.0.25</hostname>

<interface-name>ge-0/0/2.0</interface-name>

<arp-table-entry-flags>

<none/>

</arp-table-entry-flags>

</arp-table-entry>

<arp-table-entry>

<mac-address>10:c3:7b:92:d2:59</mac-address>

<ip-address>10.1.0.26</ip-address>

<hostname>10.1.0.26</hostname>

<interface-name>ge-0/0/2.0</interface-name>

<arp-table-entry-flags>

<none/>

</arp-table-entry-flags>

</arp-table-entry>

<arp-table-entry>

<mac-address>00:16:e0:32:e8:a1</mac-address>

<ip-address>10.1.0.27</ip-address>

<hostname>10.1.0.27</hostname>

<interface-name>ge-0/0/2.0</interface-name>

<arp-table-entry-flags>

<none/>

</arp-table-entry-flags>

</arp-table-entry>

<arp-table-entry>

<mac-address>64:9a:be:cb:1a:0c</mac-address>

<ip-address>10.1.0.28</ip-address>

<hostname>10.1.0.28</hostname>

<interface-name>ge-0/0/2.0</interface-name>

<arp-table-entry-flags>

<none/>

</arp-table-entry-flags>

</arp-table-entry>

<arp-table-entry>

<mac-address>d8:38:fc:38:25:40</mac-address>

NOTE: output  cut

{  review policy hit counts  }

% curl 10.1.1.1:3001/rpc/get-security-policies-hit-count -u kfelix

Enter host password for user 'kfelix':

<policy-hit-count xmlns="http://xml.juniper.net/junos/15.1X49/junos-security-policy">

<logical-system-name>root-logical-system</logical-system-name>

<policy-hit-count-entry>

<policy-hit-count-index>1</policy-hit-count-index>

<policy-hit-count-from-zone>trust</policy-hit-count-from-zone>

<policy-hit-count-to-zone>trust</policy-hit-count-to-zone>

<policy-hit-count-policy-name>trust-to-trust</policy-hit-count-policy-name>

<policy-hit-count-count>623</policy-hit-count-count>

</policy-hit-count-entry>

<policy-hit-count-entry>

<policy-hit-count-index>2</policy-hit-count-index>

<policy-hit-count-from-zone>trust</policy-hit-count-from-zone>

<policy-hit-count-to-zone>untrust</policy-hit-count-to-zone>

<policy-hit-count-policy-name>trust2untrust</policy-hit-count-policy-name>

<policy-hit-count-count>7839</policy-hit-count-count>

</policy-hit-count-entry>

<policy-hit-count-entry>

<policy-hit-count-index>3</policy-hit-count-index>

<policy-hit-count-from-zone>trust</policy-hit-count-from-zone>

<policy-hit-count-to-zone>untrust</policy-hit-count-to-zone>

<policy-hit-count-policy-name>COMMON</policy-hit-count-policy-name>

<policy-hit-count-count>31049</policy-hit-count-count>

</policy-hit-count-entry>

<policy-hit-count-entry>

<policy-hit-count-index>4</policy-hit-count-index>

<policy-hit-count-from-zone>trust</policy-hit-count-from-zone>

<policy-hit-count-to-zone>untrust</policy-hit-count-to-zone>

<policy-hit-count-policy-name>ALLOWCUST53</policy-hit-count-policy-name>

<policy-hit-count-count>0</policy-hit-count-count>

</policy-hit-count-entry>

<policy-hit-count-entry>

<policy-hit-count-index>5</policy-hit-count-index>

<policy-hit-count-from-zone>trust</policy-hit-count-from-zone>

<policy-hit-count-to-zone>untrust</policy-hit-count-to-zone>

<policy-hit-count-policy-name>VPN</policy-hit-count-policy-name>

<policy-hit-count-count>0</policy-hit-count-count>

</policy-hit-count-entry>

<policy-hit-count-entry>

<policy-hit-count-index>6</policy-hit-count-index>

<policy-hit-count-from-zone>trust</policy-hit-count-from-zone>

<policy-hit-count-to-zone>untrust</policy-hit-count-to-zone>

<policy-hit-count-policy-name>ALLOWDNS</policy-hit-count-policy-name>

<policy-hit-count-count>917</policy-hit-count-count>

</policy-hit-count-entry>

<policy-hit-count-entry>

<policy-hit-count-index>7</policy-hit-count-index>

<policy-hit-count-from-zone>trust</policy-hit-count-from-zone>

<policy-hit-count-to-zone>untrust</policy-hit-count-to-zone>

<policy-hit-count-policy-name>ALLOWCUST222</policy-hit-count-policy-name>

<policy-hit-count-count>3599</policy-hit-count-count>

</policy-hit-count-entry>

<policy-hit-count-entry>

<policy-hit-count-index>8</policy-hit-count-index>

<policy-hit-count-from-zone>trust</policy-hit-count-from-zone>

<policy-hit-count-to-zone>untrust</policy-hit-count-to-zone>

<policy-hit-count-policy-name>ALLOWCUST220</policy-hit-count-policy-name>

<policy-hit-count-count>22524</policy-hit-count-count>

</policy-hit-count-entry>

<policy-hit-count-entry>

<policy-hit-count-index>9</policy-hit-count-index>

<policy-hit-count-from-zone>trust</policy-hit-count-from-zone>

<policy-hit-count-to-zone>untrust</policy-hit-count-to-zone>

<policy-hit-count-policy-name>DENYDNS</policy-hit-count-policy-name>

<policy-hit-count-count>895</policy-hit-count-count>

</policy-hit-count-entry>

<policy-hit-count-entry>

<policy-hit-count-index>10</policy-hit-count-index>

<policy-hit-count-from-zone>untrust</policy-hit-count-from-zone>

<policy-hit-count-to-zone>trust</policy-hit-count-to-zone>

<policy-hit-count-policy-name>policy_in_wizard_dyn_vpn</policy-hit-count-policy-name>

<policy-hit-count-count>0</policy-hit-count-count>

</policy-hit-count-entry>

<policy-hit-count-entry>

<policy-hit-count-index>11</policy-hit-count-index>

<policy-hit-count-from-zone>untrust</policy-hit-count-from-zone>

<policy-hit-count-to-zone>trust</policy-hit-count-to-zone>

<policy-hit-count-policy-name>VPNn</policy-hit-count-policy-name>

<policy-hit-count-count>0</policy-hit-count-count>

</policy-hit-count-entry>

<policy-hit-count-entry>

<policy-hit-count-index>12</policy-hit-count-index>

<policy-hit-count-from-zone>untrust</policy-hit-count-from-zone>

<policy-hit-count-to-zone>untrust</policy-hit-count-to-zone>

<policy-hit-count-policy-name>APIACCESSS</policy-hit-count-policy-name>

<policy-hit-count-count>0</policy-hit-count-count>

{ system uptime }

% curl 10.1.1.1:3001/rpc/get-system-uptime-information  -u kfelix

Enter host password for user 'kfelix':

<system-uptime-information xmlns="http://xml.juniper.net/junos/15.1X49/junos" xmlns:junos="http://xml.juniper.net/junos/*/junos">

<current-time>

<date-time junos:seconds="1542059265">2018-11-12 21:47:45 UTC</date-time>

</current-time>

<time-source> LOCAL CLOCK </time-source>

<system-booted-time>

<date-time junos:seconds="1542015547">2018-11-12 09:39:07 UTC</date-time>

<time-length junos:seconds="43718">12:08:38</time-length>

</system-booted-time>

<protocols-started-time>

<date-time junos:seconds="1542015547">2018-11-12 09:39:07 UTC</date-time>

<time-length junos:seconds="43718">12:08:38</time-length>

</protocols-started-time>

<last-configured-time>

<date-time junos:seconds="1542016213">2018-11-12 09:50:13 UTC</date-time>

<time-length junos:seconds="43052">11:57:32</time-length>

<user>kfelix</user>

</last-configured-time>

<uptime-information>

<date-time junos:seconds="1542059265">9:47PM</date-time>

<up-time junos:seconds="43748">12:09</up-time>

<active-user-count junos:format="2 users">2</active-user-count>

<load-average-1>0.50</load-average-1>

<load-average-5>0.21</load-average-5>

<load-average-15>0.11</load-average-15>

</uptime-information>

</system-uptime-information>

And finally , NOT all cli cmds  have a rpc  equal , and if you try to find the equal and none exist, the  junos will display the following output.

apiuser@SRX3400> show system processes | display xml rpc 

<rpc-reply xmlns:junos="http://xml.juniper.net/junos/15.1X49/junos">

    <message>

        xml rpc equivalent of this command is not available.

    </message>

    <cli>

        <banner></banner>

    </cli>

</rpc-reply>

Enjoy and don't hesitate  with using Junos API.

lastly keep in mind the output is in xml by default. You have two ways to display the output in json

NOTE: All examples where done on Junos versions 15.1X49-Dxxxxxx

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \