Importing Devices in Bulk

Overview

This procedure describes how to import multiple devices into SecureTrack in bulk.

Import multiple devices in bulk

Prerequisites

• CSV file with the required devices and fields

  For assistance, contact Tufin support.
  

Steps

1. Log into SecureTrack as an Administrator.

2. In the address bar of your browser, add /tools to the SecureTrack base URL.

   For example: https://192.168.1.1/tools

3. Click Import Devices.

   The tool settings are displayed.

   

4. Select the CSV file you prepared with the configuration information for the devices to import.
   

5. Click Make Query.

Fields for bulk device import

The table describes the fields required for bulk device import.

Download sample CSV file

Field	Data type	Example	Description	Syntax
management_ip	inet	'192.168.1.2'	IP address of the device (Must be reachable from ST)	a.b.c.d
management_name	text	'my_firewall'	The display name for the device in SecureTrack	Any of the following characters: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+-_#@.:;/\=!^()
management_type	text	'Netscreen'	Selecting any of these types categorizes the device vendor in the display of the device tree: Note: For TOP plugins, refer to the list at end of file	Cisco, Fortinet, Mcafee, Netscreen, NewF5 (For native support, not TOP support), PaloAltoNetworks
module_type	text	'IOS-XE-SDWAN'	For Cisco Switch and Router only: specifies the device's operating system.	For Cisco L3 Switch: 'IOS' or 'IOS-XE'. For Router: 'IOS', 'IOS-XE' or 'IOS-XE-SDWAN'
log_associated_cma	integer	''	This setting is irrelevant for this tool. Always leave empty	N/A
audit_log_source_id	integer	''	This setting is irrelevant for this tool. Always leave empty.	N/A
cp_type	text	'netscreen'	Selecting any of the below list will categorize the server type. The selection will effect what login script and parser will run for this server. It is important to select the correct option Note: For TOP plugins, refer to the list at end of file	netscreen - Juniper Netscreen devices junos - Juniper SRX, J-series devices junosStateless - Juniper M,MX devices asa - Cisco ASA devices fwsm - Cisco FWSM devices router - Cisco router devices xr_router - Cisco XR devices nexus - Cisco Nexus devices switch - Cisco Switch devices L3_switch - Cisco Layer 3 switch fortigate - Fortigate devices (not FortiManager) PaloAltoFW - Palo Alto PanOS FW devices new_bigip - F5 devices mcafeeFW - Forcepoint (formerly McAfee) Sidewinder devices
device_terminal_type	text	'ssh'	The method of connecting to the new device	ssh telnet
device_username	text	'username'	The username of the administrator account that you use to connect to the device
device_password	text	'password'	The password for the administrator account that you use to connect to the device
device_enable_password	text	'enable password'	Cisco only: The enable password for the device For non-Cisco devices, leave the field empty.
started	boolean	t	The status of the device after being started. When set to t, the device pulls the first revision when re-started or when the polling interval triggers a revision. When set to f, the device starts and pulls the first revision without any user action.	t f
disabled	boolean	f	The server status as t (disabled) or f (enabled)	t - true (disabled) f - false (enabled)
server_id	integer	'1'	Defines the SecureTrack server ID that monitors the device. To retrieve the server IDs, run the following command from the command line on the central server: kubectl exec -it deploy/st-server -c st-server -- bash -c "psql -Upostgres securetrack -h stolon-proxy -p 5432 -c 'select * from st_servers;'"	1- 65535
is_offline	boolean	f	The server status as t (offline device) or f (online device) If you use this tool for offline devices, you will need to upload the file afterwards.	t - true (offline device) f - false (online device)
is_migrated	boolean	f	This setting is irrelevant for this tool. Always use ';f'.	N/A
monitoring_use_defaults	boolean	t	The monitoring settings, whether use defaults or not. Since when using the tool you cannot configure non-defaut settings, always use ';t' (default).	N/A
customer_id	integer	1	The domain that contains the device. In non-Multi-Domain deployments, enter ';1'. In Multi-Domain deployments, to find the domain IDs, run the following command from the command line on the SecureTrack server: kubectl exec -it deploy/st-server -c st-server -- bash -c "psql -Upostgres securetrack -h stolon-proxy -p 5432 -c 'select * from customers;'"	1- 65535
monitoring_mode	text	'periodic'	The monitoring mode in which the device communicates with SecureTrack.	periodic - SecureTrack will initiate connection periodically real_time - The device will initiate a connection with SecureTrack upon configuration change
port	integer	22	The port in which SecureTrack communicates with the device. The port will be used together with the ssh/telnet option selected in device_terminal_type settings	22 - SSH default port 23 - Telnet default port 0- 65535 - Custom used port
dynamic_topology_data_mode	text	'0'	Whether dynamic topology is collected from the device. Note: If set to ';1', you must also set has_topology to ';t'	0 - Do not collect dynamic topology 1 - Collect dynamic topology
is_asbr	boolean	f	Whether global vpn labels are collected for the device, for example, for systems with multiple BGP Autonomous-systems.	f - Do not collect global vpn labels t - Collect global vpn labels
has_topology	boolean	t	Whether topology will be enabled on the device.	f - Do not enable topology t - Enable topology
to_be_deleted	boolean	f	This setting is irrelevant for this tool. Always use ';f'	N/A
is_zone_based	boolean	f	For Cisco router only: In case of Zone-Based-Firewall (ZFW) based router, select ';t'. For any other device, set as ';f'.	t - For Cisco ZFW routers only f - For all devices that are not Cisco ZFW routers
fw1_regular_log_mode	text	'0'	Whether 'Collect traffic logs for rule usage analysis' is enabled for the device	0 - Disabled (rule usage disabled) 1 - Enabled (traffic logs will be collected)
object_usage_mode	text	'0'	Whether 'Collect traffic logs for object usage analysis" is enabled for the device. Note: If this setting is set to ';t', you must also set 'fw1_regular_log_mode' to ';t'	0 - Disabled (no object usage) 1 - Enabled (traffic logs will be collected)
device_use_enable	boolean	t	For Cisco router, switch, or L3 switch device only Set to true if the device needs to run the 'enable' command. Leave this field blank for all other devices, or for Cisco devices that do not require the 'enable' command.	t - use 'enable' command
rule_optimizer_mode	text	'0'	Whether Rule Optimizer recommendations are enabled for the device. Should only be enabled for devices that support Rule Optimizer.	0 - Disabled 1 - Enabled

TOP plugins management_type and cp_type values

For TOP plugins, for the management_type and cp_type fields, use the values listed in the table.

management_type	cp_type
F5	Big IP
BlueCoat	ProxySG
McAfee	Enterprise Sidewinder 7
BlueCoat	AV
Juniper-TOP	SA
Dell	PowerConnect
Cisco-TOP	Generic-Device
Cisco-TOP	CSS
Alteon	WebOS
Cisco-TOP	Nexus
Extreme	Switch
Juniper-TOP	E-Series
Juniper-TOP	JUNOS
Dell	SMC
Netscreen	Firewall
Nortel	Router
Cisco-TOP	Catalyst
Brocade-Foundry	Switch
HP	Procurve

Cisco monitoring via SNMP

You can optionally include the ability to monitor Cisco routers using SNMP. In order to configure the devices for SNMP monitoring, you must:

1. Add the SNMP-related field names to the end of the first row
2. Enter the correct values for each field in each subsequent rows

The specific fields required are dependent on the version and mode of SNMP monitoring.

• snmp version 2

  First row: snmp_portNumber,snmp_version,snmp_enable,snmp_community

  Other rows: '161','snmp_version_2','1','user_community'

• snmp version 3, mode: NoAuthNoPriv

  First row: snmp_portNumber,snmp_version,snmp_username,snmp_enable,snmp_mode,snmp_autoprotocol,snmp_privprotocol

  Other rows: '161','snmp_version_3','user_NoAuthNoPriv','1','no_auto_no_priv','MD5','AES128'

• snmp version 3, mode: AuthNoPriv

  First row: snmp_portNumber,snmp_version,snmp_username,snmp_password,snmp_enable,snmp_mode,snmp_autoprotocol,snmp_privprotocol

  Other rows: '161','snmp_version_3','user_AuthNoPriv','pass_AuthNoPriv','1','auto_no_priv','MD5','AES128'

• snmp version 3, Mode: AuthPriv

  First row: snmp_portNumber,snmp_version,snmp_username,snmp_password,snmp_enable,snmp_mode,snmp_autoprotocol,snmp_privprotocol,snmp_privpassword

  Other rows: '161','snmp_version_3','user_AuthPriv','pass_AuthPriv','1','auto_priv','MD5','AES128','priv_password'