v1

latestOpenAPI 3.0.02026-07-243339471.1 MB

Firewall Session

Get client firewall session logs

This API endpoint retrieves sessions logs from access points, CX switches and gateways in a site based on the given client MAC and the filter.

get/network-monitoring/v1/client-firewall-sessions

Query parameters

site-idstring const required

Example:2778382

The ID of the site from which to retrieve the firewall session logs.

start-atstring date-time required

Example:2024-11-20T14:14:33Z

The start time for the query in RFC 3339 format, must be less than end-at.

end-atstring date-time required

Example:2024-11-20T14:14:33Z

The end time for the query in RFC 3339 format, must be greater than start-at.

client-macstring const required

Example:00:00:00:00:00:00

The client MAC of the source device.

filterstring const required

OData Version 4.0 filter string (limited functionality). Supports only 'and' conjunction ('or' and 'not' are NOT supported). Supported fields and operators are in the below given table.

Field	Operators	Required	Type	Default Value	Summary
applicationCategory	eq	Yes	String	N\A	Format is string. Only applicationCategory or webCategory must be set but not both. Also cannot have both applicationCategory and webCategory empty.
webCategory	eq	Yes	String	N\A	Format is string. Only applicationCategory or webCategory must be set but not both. Also cannot have both applicationCategory and webCategory empty.
deviceType	eq and in	No	String	('DEVICE_TYPE_AP','DEVICE_TYPE_GATEWAY','DEVICE_TYPE_SWITCH')	Format is a tuple that contains string. Example: ('DEVICE_TYPE_AP','DEVICE_TYPE_GATEWAY','DEVICE_TYPE_SWITCH')
deduplication	eq	No	String	true	Format is string but should only contain values true or false. Returns unique session logs if set to true

The operators are implemented as follows:

eq: Only values exactly matching the given value are returned.
in: Only values present in the given list are returned.

limitinteger

Example:20

The maximum number of items to return.

nextstring

Example:NyBErRdk6czGUyDAX5Cp

Cursor for the next page of results. Use the value returned in the next response field to retrieve the next page. Providing both next and offset in the same request returns 400 Bad Request.

offsetinteger

The offset of the item at which to begin the response. Providing both offset and next in the same request returns 400 Bad Request.

Response

Successful operation

nextstring required

Specifies the pagination cursor for the next page of resources.

offsetinteger

countinteger required

Number of items in the response.

totalinteger required

Specifies the total number of items available for a given filter query.

Example response

{
  "items": [
    {
      "type": "network-monitoring/client-firewall-sessions",
      "id": "1699550427000-10.53.110.142-b8:27:eb:61:34:f0-13.107.42.14",
      "timestamp": "1699551447000",
      "serialNumber": "CN00000000",
      "clientUsername": "aruba-test@hpe.com",
      "clientIp": "10.53.110.142",
      "destinationIp": "13.107.42.14",
      "clientRole": "guest",
      "ssidName": "guestWifi",
      "tunneledTraffic": false,
      "clientConnectionType": "wireless",
      "vlanId": 12,
      "txBytes": 5433,
      "rxBytes": 572522496,
      "sessionType": "blocked",
      "applicationName": "Netflix",
      "applicationCategories": [
        "Streaming"
      ],
      "webUrl": "netflix.com",
      "webCategories": "Streaming Media",
      "webReputation": "Trustworthy",
      "blockedSessionReason": "Web Classification",
      "deviceType": "DEVICE_TYPE_AP",
      "sessionCount": 100,
      "clientHostname": "host1"
    }
  ],
  "count": 1,
  "next": "NyBErRdk6czGUyDAX5Cp",
  "total": 101
}