topic Re: how to manage palo alto ssl/tls service profiles using cli in General Topics

how to manage palo alto ssl/tls service profiles using cli

jdprovine — Mon, 25 Jul 2016 18:55:36 GMT

Its easy enought to change the ssl/tls service profile in the gui but how is it done throught the cli. I want to make sure I know how to do it in case I mess up my gui access.

Re: how to manage palo alto ssl/tls service profiles using cli

TranceforLife — Mon, 25 Jul 2016 19:38:16 GMT

Hi,

The best way to learn is to compare the config. So before commit, you have the option to preview the changes and choose all

> set shared ssl-tls-service-profile SSL/TLS-GP protocol-settings max-version
max Max
tls1-0 TLSv1.0
tls1-1 TLSv1.1
tls1-2 TLSv1.2

Re: how to manage palo alto ssl/tls service profiles using cli

jdprovine — Mon, 25 Jul 2016 19:43:46 GMT

So to go back and change these using the cli is to record the original settings and then go in the cli, run this command

set shared ssl-tls-service-profi;e SSL/TLC-GP protocol-settomg max-version (what it was before you changed it

Re: how to manage palo alto ssl/tls service profiles using cli

TranceforLife — Mon, 25 Jul 2016 19:51:23 GMT

Hi,

Palo has really powerful GUI, so l am trying to use it all the time when I can. For the troubleshooting, it is better to use both CLI and GUI. Let's say you configure something and want to remember the CLI commands or make a note of it. Press commit, chose "Preview changes" then lines of context "all" and check the commands so next time you can modify or configured using CLI if you wish to.

Cheers,

Myky

Re: how to manage palo alto ssl/tls service profiles using cli

jdprovine — Mon, 25 Jul 2016 19:58:15 GMT

Great advice. The thing is we are change the ssl/tls service profile for the management interface and just to be safe we wanted to make sure if we lost access to it through the gui interface we had the option to use the cli to access and change it bakc

Re: how to manage palo alto ssl/tls service profiles using cli

jdprovine — Mon, 25 Jul 2016 20:13:52 GMT

oh this is just the output of your config audit, its not how to set it using the cli commands

Re: how to manage palo alto ssl/tls service profiles using cli

TranceforLife — Mon, 25 Jul 2016 20:22:14 GMT

yes it is but you still have the option to create a new one:

> set shared ssl-tls-service-profile
SSL/TLS-GP SSL/TLS-GP
sss sss
<value> Profile name