topic Re: Security rule says disabled no for an enabled policy in General Topics

Security rule says disabled no for an enabled policy

inderjit21 — Wed, 13 Mar 2024 01:35:35 GMT

I have 2 firewalls with identical config running same PANOS. The policy in question is enabled on both the firewalls.

But one firewall has an extra line in cli( which is picked in daily diff)

set rulebase security rules "rule name" disabled no - So it is saying policy is not disabled but enabled.

Why is it showing only for 1 enabled policy and not for all other enabled policies or on 2nd firewall with identical config.

Re: Security rule says disabled no for an enabled policy

JayGolf — Wed, 13 Mar 2024 05:19:52 GMT

HI @inderjit21 ,

Can you share a snippet of both CLI outputs?

Re: Security rule says disabled no for an enabled policy

inderjit21 — Wed, 13 Mar 2024 05:33:19 GMT

Below is the config for policy in question. Only difference is 1 firewall has addtional last line.

Policy is enabled on both the firewalls.

set rulebase security rules "rule_name" profile-setting group group_name
set rulebase security rules "rule_name" to outside
set rulebase security rules "rule_name" from inside
set rulebase security rules "rule_name" source source_name
set rulebase security rules "rule_name" destination [ urls ]
set rulebase security rules "rule_name" source-user any
set rulebase security rules "rule_name" category any
set rulebase security rules "rule_name" application any
set rulebase security rules "rule_name" service [ https "tcp-8686" ]
set rulebase security rules "rule_name" source-hip any
set rulebase security rules "rule_name" destination-hip any
set rulebase security rules "rule_name" action allow
set rulebase security rules "rule_name" description *****
set rulebase security rules "rule_name" log-setting panorama
set rulebase security rules "rule_name" disabled no

Re: Security rule says disabled no for an enabled policy

JoergSchuetter — Wed, 13 Mar 2024 07:41:52 GMT

Hello

The value of "disabled" is set to "no" as a default value. You will only see the "disabled" keyword if you had disabled the rule (where the key-value pair "disabled" - "yes" was added). Re-enabling the rule changes the value to "no" (instead of removing the line).

Re: Security rule says disabled no for an enabled policy

BPry — Wed, 13 Mar 2024 13:06:53 GMT

@inderjit21,

Just to add on to the correct answer @JoergSchuetter already gave, you can safely remove it completely if it bugs you to have that difference between the two units. As mentioned, if not present in the configuration that is the default assumed value.