topic Re: Adding Security Profile Group to Policies in Expedition Discussions

Adding Security Profile Group to Policies

ROHO — Mon, 29 Oct 2018 20:29:08 GMT

Converting from ASA to PAN.

Is there a way to apply a Security Profile Group to a large # of security policies. One can only create a snippet for the individual profiles but not for a group. Tried to edit the policy itself and manually add a group name. It took it, but when we open the policy back up, it is not there.

One mentioned to crate a custom one. Tried that, but what "Type" was slected? There isn't a csutom one that we can file for a security profile group.

The PAN baseline config already has all the profiles and the group..

Re: Adding Security Profile Group to Policies

Bagheri — Mon, 29 Oct 2018 18:10:08 GMT

Yes, you have to create a custom group. You can select all the security policies (I stick to 500 at a time) and add the Security Group, and/or Logging Profile, HIP, QoS, Schedules, etc...

For example, here is one I use called "Alert_Only_Sec_Profile_Group", which groups 4 other profiles (Snippets) together.

***************profile-group*******************
<entry name="Alert_Only_Sec_Profile_Group">
<virus>
<member>Anitvirus_Alert_Only_Profile</member>
</virus>
<spyware>
<member>Anti-Spyware_Alert_Only_Profile</member>
</spyware>
<vulnerability>
<member>Vulnerability_AlertOnly_Profile</member>
</vulnerability>
<wildfire-analysis>
<member>Alert_Only_WildFire_Profile</member>
</wildfire-analysis>
</entry>

Re: Adding Security Profile Group to Policies

Bagheri — Mon, 29 Oct 2018 18:11:57 GMT

Yes you can. You need to create a group manually which includes your Security profiles. Then attach the group to your security profiles together in Expedition. Here is a group I use which takes the Security Profiles (snipetts) and groups them.

Re: Adding Security Profile Group to Policies

ROHO — Mon, 29 Oct 2018 18:14:31 GMT

Do you have to create a snippet of each of the profiles, in order to create the custom group? Am trying to avoid that and just create the group. Reason is, the baseline config already has all of the profiles, and I didn't want the tool to overwrite it. Thanks!

Re: Adding Security Profile Group to Policies

ROHO — Mon, 29 Oct 2018 18:35:54 GMT

When you created the custom group, did you add it under Snippets? If so, what "Type" did you use? Did you leave it as default, All Types?

Re: Adding Security Profile Group to Policies

Bagheri — Mon, 29 Oct 2018 18:51:40 GMT

I guess you could create blank Snippets as long as the real thing is in the PAN/PANO.

Re: Adding Security Profile Group to Policies

alestevez — Wed, 31 Oct 2018 11:44:18 GMT

Nope ! If you add an snippet "blank" the XML generation will probably fail !!. After you do the merge with your Base Config (add the profiles and groups there before import to Expedition for instance) then from the policies, right-click you will see an option called BULK CHANGES then select the profile group and select to ALL RULES 🙂

Re: Adding Security Profile Group to Policies

bagherib — Wed, 31 Oct 2018 11:51:42 GMT

Thank you Albert for the tip.

Re: Adding Security Profile Group to Policies

alestevez — Wed, 31 Oct 2018 11:58:32 GMT

https://live.paloaltonetworks.com/t5/Expedition-Articles/Expedition-make-BULK-CHANGES/ta-p/236208