I’m working on a Django project where I want to automate some firewall management tasks through an API. The basic Django application is working fine, but I’m unsure about the best way to structure the firewall integration.
The idea is to let authorized users submit requests through a Django interface and then have the application communicate with the firewall through an API. I’m particularly concerned about authentication, permissions, and making sure users can’t accidentally trigger sensitive configuration changes.
I’m also trying to figure out how to handle logging. Ideally, every request should record who made the change, what was changed, and whether the firewall accepted or rejected it. Has anyone implemented something similar with Django?
I’ve been reviewing NGFW-Engineer questions while learning firewall concepts, but I’m finding the practical Django integration side less straightforward. Should the firewall automation logic stay inside Django, or would it be better to use a separate service?
Any advice from developers who have connected Django applications with firewall APIs would be really helpful.
With the limited info provided it’s difficult to provide advice. What requirements you have would be assistive.
TBH, I have more questions than answers:
- how do you do config management now
- who is the app being developed for
- is there only going to be one type of firewall configured
- why does an end user require a service where they configure a firewall (this is for OPS/engineers)
- how often does the firewall api change?
The answer to this will come from the following question. “How do you do config management now?”
Welcome @nickdiaaz080-stack !
I’ve never done this with a pure firewall-type device like an F5 firewall, but I have done SNMP and SSH-based configuration management through a Django app.
How I did it depended upon the precise steps needed for each option. For those elements being configured through SNMP, I did that directly in the views - they were quick enough that the request wouldn’t time out waiting for a response.
For those items being configured through an SSH session, those were farmed out to a Celery task. The task used paramiko to run the session.
Note: Security for the views doing this is no different than any other security layer in your application. Access to those views is restricted to the role permitted to use those views.