Barracuda CloudGen Firewall
LAST UPDATED: SEPTEMBER 16, 2025
Overview
Barracuda CloudGen Firewall offers a comprehensive set of next-generation firewall technologies to ensure real-time network protection against a broad range of network threats, vulnerabilities, and exploits, including SQL injections, cross-site scripting, denial of service attacks, trojans, viruses, worms, spyware, and many more.
Barracuda CloudGen Firewall is available for use in:
D3 SOAR | V15.1.34.0+ |
Category | Network Security |
Deployment Options |
Connection
To connect to Barracuda CloudGen Firewall from D3 SOAR, follow this part to collect the required information below:
Parameter | Description | Example |
Server URL | The server URL of your Barracuda CloudGen Firewall instance. | https://19*.*******.145 |
API Token | The API token to authenticate the connection. | GArt************************wYYv |
API Version | The API version to use for the connection. | v1 |
Permission Requirements
Each endpoint in the Barracuda Firewall API requires a certain permission scope. The following are required scopes for the commands in this integration:
All commands will require the "Root" permission or the "Manager" role to run in D3 SOAR.
As Barracuda Firewall is using role-based access control (RBAC), the API access token is generated based on a specific user account and the application. Therefore, the command permissions are inherited from the user account’s role. Users need to configure their user profile from the Barracuda Firewall console for each command in this integration.
READER NOTE
Barracuda Firewall’s default user profiles (sorted from the most permissions to the least) are as follows:
Root
Manager
Operator
Mail
Security
Audit
Cleanup
For authentication against the REST API, a user with the respective permissions must be present either on the Control Center for centrally managed firewalls or on the firewall itself for stand-alone firewalls. In both cases, the user must have the Manager role assigned.
Refer to Administrative Role Permission and restrictions and Create an Administrator Profile for details on configuring user profiles.
Configuring Barracuda CloudGen Firewall to Work with D3 SOAR
Log in to the Barracuda Firewall Admin console.
Navigate to CONFIGURATION > Configuration Tree > Box > Infrastructure Services > REST API Service. Enable the HTTPS Interface.
Select the Access Tokens tab from the left side menu. Click + in under Access Tokens.
Enter a name for the token and click OK. The Access Tokens window will open. Click Generate new token.
Enter the admin name for the user used for authentication. In the Time to live field, enter the number of days the token should be valid for, then click OK.
Copy the access token. It will be required to build the integration connection in D3 SOAR.
READER NOTE
For more information on Barracuda CloudGen Firewall's API, including how to enable it for HTTP, enable it for HTTPS, and authentication, see REST API | Barracuda Campus.
Configuring D3 SOAR to Work with Barracuda CloudGen Firewall
Log in to D3 SOAR.
Find the Barracuda CloudGen Firewall integration.
.png?inst-v=affa99c9-69ca-4cbf-b8b5-b74ef4b8a3d6)
Navigate to Configuration on the top header menu.
Click on the Integration icon on the left sidebar.
Type Barracuda CloudGen Firewall in the search box to find the integration, then click it to select it.
Click + Connection, on the right side of the Connections section. A new connection window will appear.
Configure the following fields to create a connection to Barracuda CloudGen Firewall.
.png?inst-v=affa99c9-69ca-4cbf-b8b5-b74ef4b8a3d6)
Connection Name: The desired name for the connection.
Site: The site on which to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.
Recipient site for events from connections Shared to Internal Sites: This field is displayed when Share to Internal Sites is selected for the Site field, allowing selection of the internal site for deploying the integration connection.
Agent Name (Optional): The proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.
Description (Optional): The description for the connection.
Tenant (Optional): When configuring the connection from a master tenant site, users can choose the specific tenant sites with which to share the connection. Once this setting is enabled, users can filter and select the desired tenant sites from the dropdowns to share the connection.
Configure User Permissions: Defines which users have access to the connection.
Active: The checkbox that enables the connection to be used when selected.
System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
.png?inst-v=affa99c9-69ca-4cbf-b8b5-b74ef4b8a3d6)
1. Input the domain level Server URL.
2. Input the API Token.
3.Input the API Version. The Default value is v1.Connection Health Check: Periodically checks the connection status by scheduling the Test Connection command at the specified interval (in minutes). Available only for active connections, this feature also allows configuring email notifications for failed attempts.
Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Refer to the password vault connection guide if needed.
Test the connection.
.png?inst-v=affa99c9-69ca-4cbf-b8b5-b74ef4b8a3d6)
Click on the Test Connection button to verify credentials and connectivity. A success alert displays Passed with a green checkmark. If the connection fails, review the parameters and retry.
Click OK to close the alert window.
Click + Add to create and add the configured connection.
Commands
Barracuda CloudGen Firewall includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command, you can execute these commands independently for playbook troubleshooting.
Integration API Note
For more information about the Barracuda CloudGen Firewall API, refer to the Barracuda CloudGen Firewall API reference.
READER NOTE
Certain permissions are required for each command. Refer to the Permission Requirements and Configuring Barracuda CloudGen Firewall to Work with D3 SOAR for details.
Add IPs To Blocklist
Adds IP addresses to the IP blacklist. Note: To block the entered IPs, a network object (block list) must be created, and an access control policy must be added to prevent access from the IPs in the block list. The Create IP Block Rule command can be used to create an IP block list and the corresponding access rule. Once the block list and access rule have been created, adding or removing IPs to or from the block list can be done as needed without the need to recreate the list or rule again.
READER NOTE
The parameter Blocklist Name is required to run this command.
Run the List Forwarding Firewall Rules command to obtain Blocklist Names. Blocklist Names can be found from the returned raw data at the path $.name.
Input
Input Parameter | Required/Optional | Description | Example |
Blocklist Name | Required | The name of the blocklist to add IPs. Blocklist names can be obtained using the List Forwarding Firewall Rules command. | BlockList1 |
IPs | Required | The IP addresses to add to the blocklist. You can enter any valid IPv4 or IPv6 addresses, or CIDR address ranges. |
JSON
|
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Add IPs To Blocklist failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Barracuda CloudGen Firewall portal. Refer to the HTTP Status Code Registry for details. | Status Code: 404. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Network object not found. |
Error Sample Data Add IPs To Blocklist failed. Status Code: 404. Message: Network object not found. |
Block URLs
Creates an access rule to block URLs.
READER NOTE
When URL domains are entered to be blocked, a new forward-firewall rule is generated with the same name as the URL.
Input
Input Parameter | Required/Optional | Description | Example |
URLs | Required | The URL domains to block (e.g. phishing.sample.com). |
JSON
|
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Block URLs failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Barracuda CloudGen Firewall portal. Refer to the HTTP Status Code Registry for details. | Status Code: 409. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Rule with this name already exists. |
Error Sample Data Block URLs failed. Status Code: 409. Message: Rule with this name already exists. |
Create Access Rule For Blocklist
Creates an access rule to block IPs in the blocklists, and positions the rule to the top.
READER NOTE
The parameter Blocklist Name is required to run this command.
Run the List Forwarding Firewall Rules command to obtain Blocklist Names. Blocklist Names can be found from the returned raw data at the path $.name.
Input
Input Parameter | Required/Optional | Description | Example |
Blocklist Name | Required | The name of the IP blocklist to apply to the access rule. Blocklist names can be obtained using the List Forwarding Firewall Rules command. | BlockList2 |
Block Direction | Required | The block direction of the access rule. The available options are Inbound, Outbound and bi-direction. The default value is bi-direction (i.e., inbound and outbound). | Inbound |
IP Version | Required | The version of the IP access rule. | Inbound |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Create Access Rule For Blocklist failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Barracuda CloudGen Firewall portal. Refer to the HTTP Status Code Registry for details. | Status Code: 400. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Rule name contains invalid characters. |
Error Sample Data Create Access Rule For Blocklist failed. Status Code: 400. Message: Rule name contains invalid characters. |
Create Blocklist
Creates a blocklist object containing the IP black list. You only need to create a blocklist.
Input
Input Parameter | Required/Optional | Description | Example |
Blocklist Name | Required | The name of the IP block list. | BlockList2 |
IPs | Required | The IP addresses to add to the blocklist. You can enter any valid IPv4 or IPv6 addresses, or CIDR address ranges. You must enter at least one IP address to create the block list. |
JSON
|
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Create Blocklist failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Barracuda CloudGen Firewall portal. Refer to the HTTP Status Code Registry for details. | Status Code: 400. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Invalid IPV6 address. |
Error Sample Data Create Blocklist failed. Status Code: 400. Message: Invalid IPV6 address. |
Create IP Block Rule
Creates a blocklist object containing the IP blacklist and creates an access rule to block traffic from those IPs.
READER NOTE
The parameter Blocklist Name is required to run this command.
Run the List Forwarding Firewall Rules command to obtain Blocklist Names. Blocklist Names can be found from the returned raw data at the path $.name.
This command only allows you to create a new blocklist and specify the IP addresses to be blocked. It is not possible to add IP addresses to an existing blocklist using this command. To do this, you may use the Add IPs To Blocklist command instead.
Input
Input Parameter | Required/Optional | Description | Example |
Blocklist Name | Required | The name of the IP blocklist to use for the block rule. Blocklist names can be obtained using the List Forwarding Firewall Rules command. | BlockList2 |
IPs | Required | The IP addresses to add to the blocklist. You can enter any valid IPv4 or IPv6 addresses, or CIDR address ranges. You must enter at least one IP address to create the block list. |
JSON
|
Block Direction | Required | The block direction of the access rule. The available options are Inbound, Outbound and bi-direction. The default value is bi-direction (i.e., inbound and outbound). | Inbound |
IP Version | Required | The version of the IP access rule (i.e., IPv4 or IPv6). The default value is IPv4. | Inbound |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Create IP Block Rule failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Barracuda CloudGen Firewall portal. Refer to the HTTP Status Code Registry for details. | Status Code: 404. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Network object not found. |
Error Sample Data Create IP Block Rule failed. Status Code: 404. Message: Network object not found. |
Get Blocklist IPs
Retrieves blocked IPs from the blocklist.
READER NOTE
The parameter Blocklist Name is required to run this command.
Run the List Forwarding Firewall Rules command to obtain Blocklist Names. Blocklist Names can be found from the returned raw data at the path $.name.
Input
Input Parameter | Required/Optional | Description | Example |
Blocklist Name | Required | The name of the IP blocklist to retrieve IPs. Blocklist names can be obtained using the List Forwarding Firewall Rules command. | BlockList1 |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Get Blocklist IPs failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Barracuda CloudGen Firewall portal. Refer to the HTTP Status Code Registry for details. | Status Code: 404. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Network object not found. |
Error Sample Data Get Blocklist IPs failed. Status Code: 404. Message: Network object not found. |
List Forwarding Firewall Rules
Retrieves all forwarding firewall rules.
Input
N/A
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | List Forwarding Firewall Rules failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Barracuda CloudGen Firewall portal. Refer to the HTTP Status Code Registry for details. | Status Code: 403. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Connection timeout. |
Error Sample Data List Forwarding Firewall Rules failed. Status Code: 403. Message: Connection timeout. |
Remove IPs From Blocklist
Removes IP addresses from the IP blacklist. Note: To unblock the entered IPs, a network object (block list) must be created, and an access control policy must be added to prevent access from the IPs in the block list. You can use the Create Block List command to create an IP block list, and the Create Access Rule For Block List command to create the access rule. Once the block list and access rule have been created, adding or removing IPs to or from the block list can be done as needed without the need to recreate the list or rule again.
READER NOTE
The parameter Blocklist Name and IPs are required to run this command.
Run the List Forwarding Firewall Rules command to obtain Blocklist Names. Blocklist Names can be found from the returned raw data at the path $.name.
Run the Get Blocklist IPs command to obtain IPs. IPs can be found from the returned raw data at the path $.included[*].entry.ip.
The input IPs must be on the specified blocklist. It is recommended to use the List Forwarding Firewall Rules to obtain the desired blocklist, and use the blocklist name to run the Get Blocklist IPs command. Finally, use the resulting pairs to run this command.
Input
Input Parameter | Required/Optional | Description | Example |
Blocklist Name | Required | The name of the IP blocklist to remove IPs. Blocklist names can be obtained using the List Forwarding Firewall Rules command. | BlockList1 |
IPs | Required | The IP addresses to remove from the blocklist. You can enter any valid IPv4 or IPv6 addresses, or CIDR address ranges. You can obtain a list of currently blocked IPs using the Get Blocklist IPs command. |
JSON
|
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Remove IPs From Blocklist failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Barracuda CloudGen Firewall portal. Refer to the HTTP Status Code Registry for details. | Status Code: 404. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Network object not found. |
Error Sample Data Remove IPs From Blocklist failed. Status Code: 404. Message: Network object not found. |
Unblock URLs
Unblocks URL(s) from access rules.
READER NOTE
The input parameter URLs is required to run this command.
Run List Forwarding Firewall Rules command to obtain blocked URLs.
Ensure your input URLs are currently blocked by Barracuda CloudGen Firewall, otherwise an error message will be returned.
Input
Input Parameter | Required/Optional | Description | Example |
URLs | Required | The URL domains to unblock (e.g. phishing.sample.com). Blocked URls can be obtained using the List Forwarding Firewall Rules command. |
JSON
|
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Unblock URLs failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Barracuda CloudGen Firewall portal. Refer to the HTTP Status Code Registry for details. | Status Code: 404. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message:URLs not found. |
Error Sample Data Unblock URLs failed. Status Code: 404. Message: URLs not found. |
Test Connection
Allows users to perform a health check on an integration connection. Users can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.
Input
N/A
Output
Output Type | Description | Return Data Type |
Return Data | Indicates one of the possible command execution states: Successful or Failed. The Failed state can be triggered by any of the following errors:
More details about an error can be viewed in the Error tab. | String |
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the responses from the third-party API calls including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Test Connection failed. Failed to check the connector. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Barracuda CloudGen Firewall portal. Refer to the HTTP Status Code Registry for details. | Status Code: 404. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Token not found. |
Error Sample Data Test Connection failed. Failed to check the connector. Status Code: 404. Message: Token not found. |