topic Re: is it possible to export firewall rule only?? in General Topics

is it possible to export firewall rule only??

willstech — Thu, 21 Apr 2011 09:13:16 GMT

Hi all.

Is it possible to export security policy with CSV, PDF or txt format?? I can’t find any export menu only for firewall rule.

If it is possible, is it able to modify that exported firewall rule??

And then is it possible to import modified firewall rule to PA device??

Customer wants to review their firewall rule with readable file format.

Of course I know that PA supports export for configuration file on the Device TAB but it is included all of configure information.

I just want to know that how to export firewall policy only with CSV, PDF or etc.

Thanks,

Eugene.

Re: is it possible to export firewall rule only??

mderksen — Thu, 21 Apr 2011 10:39:59 GMT

Hi,

This is not possible with the webgui. The only way you can modify and import the configuration from the webgui is the export and import function in the device tab.

What you might try is the CLI.

Within the CLI set the output format to set (set cli config-output-format set) and then go into the configure mode. When you do an 'show rulebase' it will show you the rulebase in a readable format.

Marcel

Re: is it possible to export firewall rule only??

solsen — Thu, 21 Apr 2011 20:19:13 GMT

Hi Eugene!

I have a utility that will extract most of the configuration of the box into an Excel documnets with multiple sheets.

It will give you rulebase, custom apps, application groups, application filters , services etc.

Email me on staffan@radpoint.se and I will send you a copy and you can try it to see if it does what you are looking for.

Best regards Staffan

Re: is it possible to export firewall rule only??

choff123 — Fri, 15 Jun 2012 18:23:23 GMT

so, exports of security policies are still not available?

i really hate tring to audit 150+ rules in the web gui.

Re: is it possible to export firewall rule only??

mikand — Sat, 16 Jun 2012 06:14:52 GMT

I think solsens excel-utility can be handy for this.

Otherwise you can export the running-config.xml and run it through sed or such.

The interresting stuff is between <rulebase> and </rulebase> (to get not only the rules but also any profiles or such) and if you want just the security rules you go for the stuff between <security> and </security>.

Another method (already described), specially if you are not friendly to xml, is to use cli and enable set-commands and then just do a "show running-config" (which you then run through sed to only keep the interresting stuff).

Re: is it possible to export firewall rule only??

choff123 — Mon, 18 Jun 2012 16:33:49 GMT

so, its roll your own then .. ok, thanks mikand.

btw: i dont see 'solsens excel-utility' on this forum or google.

Re: is it possible to export firewall rule only??

mikand — Tue, 19 Jun 2012 09:00:51 GMT

I think you must email him to get a copy, while you email him - ask if he cant publish he utility online? 🙂

Re: is it possible to export firewall rule only??

choff123 — Wed, 20 Jun 2012 21:58:01 GMT

do you have an address?

I just stared my audit via the giu :|, this is going to be painful

Re: is it possible to export firewall rule only??

mikand — Wed, 20 Jun 2012 22:03:01 GMT

His email is posted in the message he posted earlier: https://live.paloaltonetworks.com/message/6354#6354

Re: is it possible to export firewall rule only??

choff123 — Wed, 20 Jun 2012 22:16:19 GMT

sry, thanks

Re: is it possible to export firewall rule only??

licenselu — Thu, 21 Jun 2012 07:06:08 GMT

Hello,

This message is targeted to PA team...

It would be nice to provide an official tools to export firewall rules, NAT rules, Decryption rules in HTML, PDF format.

Checkpoint has an official tools called Web Visualization tools.

PA, please help us...

Regards,

Hedi

Re: is it possible to export firewall rule only??

slawek.kunach — Thu, 21 Jun 2012 13:27:51 GMT

Seconded!

Re: is it possible to export firewall rule only??

James — Thu, 21 Jun 2012 13:37:23 GMT

Did you try this already?

Thanks

James

Re: is it possible to export firewall rule only??

licenselu — Thu, 21 Jun 2012 14:09:49 GMT

Hello,

I tried the Excel using XML API method.

It works BUT it's not friendly as the Checkpoint Tools...

Regards,

Hedi

Re: is it possible to export firewall rule only??

dwilliamsonami — Thu, 21 Jun 2012 16:48:06 GMT

Just an FYI to all. In the instructions for Excel using XML API it references Using the XML API in the paragraph in step 2. In the instructions on Using the XML API, there is a typo in 01. of Key Generation https://hostname/esp/restapi.esp?type=keygen&user=username&passwordpassword=password. It should be &password=password.

Re: is it possible to export firewall rule only??

choff123 — Thu, 21 Jun 2012 21:45:23 GMT

does not work for me, maybe i should just make a feature request...

Re: is it possible to export firewall rule only??

dwilliamsonami — Thu, 21 Jun 2012 22:21:04 GMT

I had the same results following the directions with Excel. I followed the same directions but instead used a web browser to create the key, then I used the key (again from the web browser) to create the xml. I then saved the xml to a file and imported the file using Excel data import. Though the spreadsheet is not pretty. I have multiple lines for each rule.

Re: is it possible to export firewall rule only??

choff123 — Thu, 21 Jun 2012 22:40:57 GMT

thanks, ill give that a try.

Re: is it possible to export firewall rule only??

emcorenetwork — Fri, 13 Jul 2012 21:43:42 GMT

Has anyone else made a feature request? I made one through Santiago this past week.

Re: is it possible to export firewall rule only??

ksteves1 — Wed, 25 Jul 2012 00:44:00 GMT

I have been thinking about how to do basic (think text or html output) customizable reporting from XML and as an experiment implemented something in Python that uses a templating language call "JSON Template". I'll attach the current documentation which has examples and if there is interest I can try to post it to devcenter.