topic Re: Easy way to copy a policy from one firewall to another? in General Topics

Easy way to copy a policy from one firewall to another?

ghughes_itx — Tue, 22 Nov 2022 19:53:40 GMT

Good afternoon!

I have a set of Palo Alto PA-820s and 850s that I'd like to converge their configurations. For instance, have the same whitelist or blacklist policy outlines that I can add or remove websites, countries, and so forth.

I see I can share policies between virtual routers, but is there an easy or easier way to copy a policy from one firewall to another without redoing the entire configuration?

Thanks to all!

Gregg

Re: Easy way to copy a policy from one firewall to another?

Metgatz — Tue, 22 Nov 2022 20:14:38 GMT

Hello @ghughes_itx , well in this case, the flagship product to share configurations, for example, policies, objects, network settings, among others is PANORAMA. But if it is not within the plans to implement, due to licensing issues, costs, operation, etc., then the other possible alternative, is on the one hand to try in both firewalls, to match certain config, for example Zones, Network Segments (if possible), names and / or references of Security Profiles.

I would think like this, first standardize and homologate manually, with care, these configs.

Then for each change you make, for example take the same command and apply it via CLI on the other firewall, trying to speed up the execution a bit more.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHoCAK

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHoCAK#:~:text=The%20following%20example%20demonstrates%20how%20to%20view%20a%20configuration%20in%20%22set%22%20format.

If you check those links there you have the examples at the view level, then when you run a change, you take the base CLI commands and apply it and adjust it on the other firewall.

You can copy the config but this is more global, to copy the config, from one firewall to another.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-cli-quick-start/use-the-cli/use-secure-copy-to-import-and-export-files/export-a-saved-configuration-from-one-firewall-and-import-it-into-another#id84f62535-0ecb-411d-87b8-993aaea5566b

Regards

Re: Easy way to copy a policy from one firewall to another?

OtakarKlier — Tue, 22 Nov 2022 21:00:18 GMT

Hello,

The other option would be to configure one of the devices with settings and policies you want. Export the XML file, delete everything in the xml except for what you want to transfer to the other. Then import the truncated xml to the other device,

Hope this makes sense.