topic Re: Difference between Rulebase Security Rules and security policy in CLI in Next-Generation Firewall Discussions

Difference between Rulebase Security Rules and security policy in CLI

Ian_Rabensteine — Wed, 18 Dec 2024 20:20:10 GMT

Hello!

I am struggling with some CLI config as we don't have access to the gui at the moment. I am trying to create an allow rule for ping, and searching around has directed me to use the syntax "set rulebase security rule".

I did that and the rule committed successfully. When I 'show run security policy' I see the rule I just created at the very end. I want to move it up in the list as its underneath a deny all rule. However, when I try to use the "move" command, no matter what target rule I choose it says it doesn't exist. If I tell it to move the rule to the top, it says it's already at the top. If I do a 'show rulebase security rules' the rule I just created is the only rule listed. So it seems like the rulebase security rules and the security policy are different, but then why does the rule I just created show up in both places? Is there a different way of adding a security policy?

In case its helpful information, the rules that exist on the firewall exist in the "pre rules" section of the security policy, which is where I want the new rule to go as well.

Re: Difference between Rulebase Security Rules and security policy in CLI

emr_1 — Thu, 19 Dec 2024 01:35:33 GMT

From the keyword "pre rules", I guess you are using Panorama, and also you are configuring new security rule directly to PAN device (PA-xxx).

If so, you need to configure new rule on panorama, not on PAN device.

Here is brief diagram how security rule works when you are using panorama.

In addition to above, you can't add/edit/delete rules which are pushed from panorama on PAN device.

Hope this helps you.

Re: Difference between Rulebase Security Rules and security policy in CLI

Ian_Rabensteine — Thu, 19 Dec 2024 13:50:25 GMT

Thanks for the reply. We do manage devices from Pano typically, and this device was initially configured via pano here at the home office. However, the device is now physically 3 hours away and we only have access via console through a cellullar WTI device. We have lost communication to the device through pano and are trying to use the WTI console access to troubleshoot via ping, but all ping is blocked. This is why I am trying to add a rule to allow ping. It's definitely possible to directly configure a device that has been configured via pano, I have done it before. Just not adding or removing rules. It'll cause some sync issues that will be need to be corrected, but it definitely takes configuration via cli. I just need to figure out the right config.