SonicOS API to create service object and service group - Postman and cURL

This article describes the steps involved in creating Service objects and Service group using SonicOS APIs. SonicOS API provides an alternative to the SonicOS Command Line Interface (CLI) for configuring selected functions.

SonicOS API is disabled by default in SonicOS. Any attempt to access SonicOS API while it is disabled results in an HTTP 403 Forbidden error. To use the SonicOS API, you must enable it, either through the SonicOS Management Interface or from the CLI.

This article only explains how to add an Service group and add address objects to it. Please follow the below articles for additional assistance:

1. Introduction to SonicOS API
2. Creating Address Object and Address Group Object using SonicOS API cURL
3. Adding Multiple Address Objects Using SonicOS API 
4. SonicOS API for adding Address group in Postman and cURL
5. Add new address object to an existing group - SonicOS API

You are free to choose Swagger, Postman, Git bash, or any application that allows API calls. If you are using a Linux-based operating system, you can execute cURL from the terminal. Please refer to https://sonicos-api.sonicwall.com for the entire list.  

Only the first part of this article would change, depending on the SonicWall model you use. Commands are the same for both Gen6 and Gen7 SonicWall devices. 

For this article, I'm using Postman App and will be showing the commands to run on cURL for each step.

Please enable the SonicOS API module in the SonicWall UI.

Gen 7: Enable SonicOS API Gen7

Gen 6: Enable SonicOS API Gen6

The above KB also has the steps on how to log in using API Applications.

 CAUTION: My SonicWall IP address is 192.168.168.168 with user credentials as admin/password. This has to be kept in mind while running the commands from screenshots. 

Step 1: Login using SonicOS API

The following 3 steps need to be performed for every API request.

 NOTE: https://IP-address:port/-- Replace this with your SonicWall's Public or private IP address with the right management port number (If the management port is 443, you can directly use https:// followed by the IP address without the port number too).

a) The HTTP method should be POST and we need to use the URL: https://192.168.168.168/api/sonicos/auth
Under the authorization tab, select Basic Auth and mention the correct admin credentials.

b) Under the settings tab, turn OFF the Enable SSL certificate verification if the firewall is using a self-signed certificate for management.


c) Under the headers tab, include application/JSON as the value for keys Accept and Content-type.
 

d) The Gen 7 devices are token-driven. Use the {"override" : true} under the body to override any older tokens. This is used only during login.
After this, click on the Send button and then you can see the response on the section below. The response should contain a message: "success".


e) After this, click on the Send button and then you can see the response on the section below. The response should contain a message: "success".

cURL code:

Step 2: Create Service Object

For this example, there are 2 service objects that will be created

• TCP 5060
• UDP 5060-5082

In Postman:

cURL command:

curl -L -X POST 'https://192.168.168.168:443/api/sonicos/service-objects' \
-H 'Content-Type: application/Json' \
-H 'Accept: application/Json' \
-H 'Authorization: Basic YWRtaW46cGFzc3dvcmQ=' \
--data-raw '{
    "service_objects": [
        {
            "name": "ServiceObject-TCP",
            "tcp": {
                "begin": 5060,
                "end": 5060
            }
        },
        {
            "name": "ServiceObject-UDP",
            "udp": {
                "begin": 5060,
                "end": 5084
            }
        }
    ]
}'

Step 3: Create a Service Group

Create a service group named "ServiceGroup" and add 'ServiceObject-TCP to it. For now, I'm only adding one object, to show you how to add another object to an existing group. 

 NOTE: Whenever a group is created, there should be at least one object added. Otherwise, there will be an error while creating the group 

In Postman:

cURL command:

curl -L -X POST 'https://192.168.168.168/api/sonicos/service-groups' \
-H 'Content-Type: application/Json' \
-H 'Accept: application/Json' \
-H 'Authorization: Basic YWRtaW46cGFzc3dvcmQ=' \
--data-raw '{
    "service_group": {
        "name": "ServiceGroup",
        "service_object": {
            "name": "ServiceObject-TCP"
        }
    }
}'

Step 4: Add more service objects to the existing service group

Now add 'ServiceObject-UDP' to the existing group. The command uses the PUT operation

In Postman:

cURL command:

curl -L -X PUT 'https://192.168.168.168/api/sonicos/service-groups/name/ServiceGroup' \
-H 'Content-Type: application/Json' \
-H 'Accept: application/Json' \
-H 'Authorization: Basic YWRtaW46cGFzc3dvcmQ=' \
--data-raw '{
    "service_group": {
        "name": "ServiceGroup",
        "service_object": {
            "name": "ServiceObject-UDP"
        }
    }
}'

Step 5: Committing all the configurational changes made with APIs:

This step is very important to save your changes.

In Postman:

cURL code:

curl -k -X POST "https://192.168.188.200/api/sonicos/config/pending" -H "accept: application/Json"

 CAUTION:  If you miss performing the action and log out, you will lose all the configuration changes made in the current session. 

Step 6: Log out the SonicWall with API:

 It is recommended to log out from the SonicWall via API once the desired configuration is committed.

In Postman:

cURL code

curl -k -i -u "admin:password" -X DELETE https://192.168.168.168:443/api/sonicos/auth

         “admin:password” – needs to be replaced with the actual admin username and password for your SonicWall.