topic Re: Rules from One Zone to another Zone in General Topics

Rules from One Zone to another Zone

ToughGuy_PAN — Mon, 22 Aug 2022 14:22:08 GMT

Hello All,

from the GUI i can get all the security policies from one zone to another, However, from the CLI, is there a way?

for example : i need all the policies from Orange_Zone to Free- App_Zone

"Orange to DEVDB11-1; index: 1333" {
from Orange_Zone;
source 172.24.x.x/24;
source-region none;
to Free-App_Zone;
destination 172.24.x.x;
destination-region none;
user any;
source-device any;
destinataion-device any;
category any;
application/service [0:mssql-db-base/tcp/any/1433 1:mssql-db-encrypte/tcp/any/1433 2:mssql-db-unencryp/tcp/any/1433 ];
action allow;
icmp-unreachable: no
terminal yes;

Re: Rules from One Zone to another Zone

ToughGuy_PAN — Mon, 22 Aug 2022 15:42:28 GMT

Also, can some one please tell me how to view the rules on panorama in different device groups?

Re: Rules from One Zone to another Zone

PavelK — Mon, 22 Aug 2022 23:36:24 GMT

Hello @ToughGuy_PAN

you can use below CLI to view pre or post policy in specific Device Group:

show device-group <Device Group Name> pre-rulebase security rules
show device-group <Device Group Name> post-rulebase security rules

Kind Regards

Pavel

Re: Rules from One Zone to another Zone

ToughGuy_PAN — Tue, 23 Aug 2022 09:10:59 GMT

Hello @PavelK

Thanks for the below. However, my question was not clearly directed. Let me be more specific

We Have many zones on our PA firewall and I need the rule base between specific zones.

Once I have them , need to replicate them to Prisma, so that most of the company users in those zones can make full utilization of the Prisma GP.

Hope it makes sense. Please advise, if you need any further information

Re: Rules from One Zone to another Zone

BPry — Tue, 23 Aug 2022 19:03:41 GMT

@ToughGuy_PAN,

Just to be more specific about what you're trying to do, because it's still not completely clear to me, are you just looking to migrate your existing firewall's rulebase into Prisma Access? I'm assuming that you aren't managing Prisma Access with Panorama?

Re: Rules from One Zone to another Zone

ToughGuy_PAN — Tue, 23 Aug 2022 20:13:35 GMT

@BPry

Apologies, we are managing Prisma GP (cloud services) via Panorama

not the complete rule base, but only for the zones that are used to hit the Internet.

Zone by Zone we need to replicate to Prisma, so that most of the staff in those zones can take full advantage of Prisma GP

Let me know if that make sense