topic Removal of Targets from Policy in Panorama Discussions

Removal of Targets from Policy

GrantCampbell4 — Tue, 22 Oct 2024 13:36:56 GMT

I have a number of firewalls managed in Panorama that are to be decommissioned.

Some of these firewalls are in Device Groups with several thousand policy entries. Annoyingly they have been assigned the firewalls in the target column.

Does anyone have a documented method as to how to remove targets from a Device Group in Panorama quickly and/or efficiently?

Regards

Re: Removal of Targets from Policy

chris.short — Thu, 24 Oct 2024 00:57:12 GMT

We've had a scenario where we had to change hundreds of rules from targeting specific firewalls to target 'any'.

In Panorama CLI you can use:
#show | match "target devices <serial>

This will get you an output of 1000s of policies with that firewall as a target.

#set device-group <deviceGroup> post-rulebase security rules <ruleName> target devices <serial> vsys vsys<X>

Using that output you can edit in notepad to be for example: (really just need to change set to delete and remove the trailing vsys vsysX)

#delete device-group <deviceGroup> post-rulebase security rules <ruleName> target devices <serial>

If you get rid of all firewall targets on a rule, the rule target reverts to 'any' which sounds like what you're after.

Bang the thousands of lines into CLI, if you haven't already, you may need to use the 'set cli config-output-format set' command

Hope this helps

Re: Removal of Targets from Policy

TomYoung — Thu, 24 Oct 2024 01:32:33 GMT

Hi @GrantCampbell4 ,

Simplifying what @chris.short said:

user@panorama> set cli config-output-format set user@panorama> configure user@panorama# show | match "target devices <serial>"

Copy output to notepad. Replace 'set' with 'delete' and paste into the CLI. The docs say if you want to paste more than 20 lines at a time, use the 'set cli scripting-mode on' command in operational mode. Then turn it off with 'set cli scripting-mode off'.

You can omit the S/N in the show command to see all of the targets in the configuration.

Thanks,

Tom