topic How do I find out every place an object is used? in General Topics

How do I find out every place an object is used?

Demast — Thu, 26 Jun 2014 16:07:29 GMT

Does anyone know a good way to find out everywhere an object is used?

What security and NAT rules is it in?
What address groups is it in?
What are the rules the address groups the object is in used?

It would be great if there were an easy way to this.

Re: How do I find out every place an object is used?

ericgearhart — Thu, 26 Jun 2014 16:33:11 GMT

PA really, really needs to implement Check Point's "Where used?" functionality. The backend code that determines where objects are used is already there, because if you try to delete an object that is used in the firewall rule base it won't let you, and it will prompt you as to where the object exists.

That's the closest I've been able to get to "Where used?" - try to delete the object, and if it doesn't let you it will tell you where the object is used. If it does let you delete it you can just "Revert to last saved configuration"

Re: How do I find out every place an object is used?

Demast — Thu, 26 Jun 2014 18:03:24 GMT

Thanks for the advice, I was afraid that might be the case. I will put in a feature request (or another vote for any existing FR).

I will add that Cisco ASA has this capability as well.

Re: How do I find out every place an object is used?

ericgearhart — Thu, 26 Jun 2014 18:04:28 GMT

If you get an FR let me know, I'd like to talk to my SE and vote for that FR too.

Thanks,

Eric

Re: How do I find out every place an object is used?

kadak — Thu, 26 Jun 2014 18:32:24 GMT

Hello ericgearhart and DMast,

Following is the feature request submitted to the development team for 'Where used objects functionality':

FR ID : 1285

Thanks and regards,

Kunal Adak

Re: How do I find out every place an object is used?

Demast — Thu, 26 Jun 2014 19:37:27 GMT

Thanks kadak! I will add my vote to the FR.

Re: How do I find out every place an object is used?

Antwoinne — Fri, 27 Jun 2014 14:58:47 GMT

I will definitely be adding my vote as well. Thanks

Re: How do I find out every place an object is used?

pulukas — Sat, 28 Jun 2014 00:32:15 GMT

Thanks for submitting. I've added a vote for FR ID : 1285 too.

Right now I use the following technique

Change the display of configuration to set mode:

set cli config-output-format set

the pipe the configuration to match with the address object name

show vsys | match net-192.168.1.0-24

this pulls out all the set commands that contain the object name.

Re: How do I find out every place an object is used?

ericgearhart — Mon, 30 Jun 2014 13:07:32 GMT

Thank you Steven for sharing! I'm going to go ahead and steal your idea and share it with my team 🙂