topic Re: Selective cut-paste of the config in General Topics

Selective cut-paste of the config

smunzani — Sat, 17 Dec 2011 20:54:02 GMT

Hi,

I have to deploy 9 PA boxes. I would like to create all objects on one box and copy that section to all the boxes. How do I achieve that? The config seems to be in XML format and section cut-paste is not working on command line. So far only way I could see it working is export the config from GUI to xml format, edit whole file in notepad and bring it back. However this task is cumbersome.

Is there any way to just cut-paste a section of the config at command line?

Thanks,

Sam

Re: Selective cut-paste of the config

wscmtts — Sun, 18 Dec 2011 06:22:16 GMT

Unfortunately it's not clear to me how what "{scp|tftp} import configuration" in the CLI does.

Nevertheless you can generate a file containing the CLI commands to create the objects.

"set address foo ip-netmask 1.2.3.4/32"

and paste the text file in the CLI in configuration mode (if it's not too big, probably).

or buy Panorama ...

Re: Selective cut-paste of the config

Retired Member — Sun, 18 Dec 2011 20:29:54 GMT

There is not an easy way to load just parts of the configs. XML editing is probably the easiest way. You could create one template config with all your objects. Then export that and use a text editor to find and replace parts such as hostname, system IP, etc. Then import that to whichever box requires it. Other option is as use 'set' commands as Wscmtts mentioned. To view your configs in 'set' format, use below CLI command.

set cli config-output-format set

Then view your configs with 'show config running'.

Regards

-Richard

Re: Selective cut-paste of the config

smunzani — Mon, 19 Dec 2011 16:09:03 GMT

Below is how I got around it. Thanks to somebody's good documentation on the support site.

On source PA box:

admin@myFW> set cli config-output-format set

configure

# Run following commands and capture output in a text file

show address

show address-group

show rulebase security rules

show rulebase nat rules

# Make any edits offline.

On destination PA box:

admin@myFW> set cli script-mode on

# paste all config lines.

set cli script-mode off

This is what I did. But I was hoping to export full config in set commands mode and edit it offline and then paste again. I could not find a command that gave me full config including routing, global protect et all.

Thanks,

Sam

Re: Selective cut-paste of the config

ktahani — Thu, 11 Oct 2012 04:11:11 GMT

Thanks to these posts.

Once you've entered admin@myFW> set cli config-output-format set

Enter at CLI: configure

Then all you have to do is enter (at prompt with #): show (press enter)

This will spill out all configs including bunch of encrypted garble which you'll have to remove from your text. Haven't figured out if that could be routed to tftp or text file yet. But, a great start.

This is better than editing xml files.

Re: Selective cut-paste of the config

nextgenhappines — Tue, 05 Feb 2013 20:13:25 GMT

I tried the method mentioned above, set cli config-output-format-set output and show config cut and paste the config to another firewall. I ran into the config output are not always in order, it make the my jobs very difficult. Editing offline are not always best options either.

To those who have used to JunOS, you know about the load [replace|merge|set] terminal command (example)

If you are interested to see similar features available on PANOS, please submit a feature request with your SEs or resellers.

Thanks,

Ernest