Script for pulling disabled rule in set format

D.Verma502651 — Wed, 06 Aug 2025 14:24:10 GMT

Hi Team
I am trying to pull the details of disabled rule in set format. I am using pan-sdk .
I can pull the complete list but not able to retrieve only rule which are disabled.
And is to possible to pull rule in "set" format or need to use XML API ?

Any pointer will help here.

Thanks,

Deepak

Re: Script for pulling disabled rule in set format

aleksandar.astardzhiev — Tue, 19 Aug 2025 22:13:16 GMT

Hi @D.Verma502651 ,

There is one "quick and dirty" way to achieve what you want, without any scripting or API.

Little fun facts first:
- PanOS is utilizing the "less" pager when showing any file (being log or config file)

- less has a build-in feature that allow you to show only the lines of the file which match a given pattern - https://man7.org/linux/man-pages/man1/less.1.html

  &pattern
              Display only lines which match the pattern; lines which do
              not match the pattern are not displayed.  If pattern is
              empty (if you type & immediately followed by ENTER), any
              filtering is turned off, and all lines are displayed.
              While filtering is in effect, an ampersand is displayed at
              the beginning of the prompt, as a reminder that some lines
              in the file may be hidden.  Multiple & commands may be
              entered, in which case only lines which match all of the
              patterns will be displayed.

In a nutshell you have "grep" capabilities for the config file right in the firewall.

Armed with this information you could:

1. Login to Firewall/Panorama CLI

2. Set the config output to set

user@My-PAN-FW> set cli config-output-format set

3. Enter configure mode and climb the configuration hierarchy

# For Panorama [edit] user@My-Panorama# edit device-group My-PAN-FW pre-rulebase security [edit device-group My-PAN-FW pre-rulebase security] user@MY-Panorama# show # For Firewall [edit] user@My-PAN-FW# edit rulebase security [edit rulebase security] user@My-PAN-FW# show

4. As your firewall policy is longer than your terminal the output will be presented by the "less". While inside "less" you enter the "&" followed by the pattern you search. In your case you look for all rules that are disabled

&disabled\ yes

Above will return all lines where the "disabled yes" is found. Since the output is in set format the name of the firewall rule will be in the same line.

topic Script for pulling disabled rule in set format in Next-Generation Firewall Discussions

Script for pulling disabled rule in set format

Re: Script for pulling disabled rule in set format