topic Re: Changing zone name in 100 security policies? in General Topics

Changing zone name in 100 security policies?

ghostrider — Sat, 22 Oct 2016 21:49:45 GMT

Hello Experts

I want to change the zone name. There are 100 security policies associated with that zone. How I can do it quickly, like is there any replace pattern command available (like in Juniper) to replace th zone name any where in configuration?

Regards,

Re: Changing zone name in 100 security policies?

nextgenhappines — Sat, 22 Oct 2016 23:49:18 GMT

I believe if you just change the zone name under network -> zone, that will automatic update security rules which has that zone applied.

Re: Changing zone name in 100 security policies?

ghostrider — Mon, 24 Oct 2016 10:14:28 GMT

Hello

No it is not doing that

Re: Changing zone name in 100 security policies?

kiwi — Mon, 24 Oct 2016 10:43:05 GMT

Hi,

Are you doing this directly on a firewall or changing a Panorama Template ?

-Kim.

Re: Changing zone name in 100 security policies?

ghostrider — Mon, 24 Oct 2016 11:36:21 GMT

Hello Kiwi

If I do on the firewall directly then next time I push the config from Panorama then it will be deleted. I have to do on Panorama. Is there any way I can manually edit the replace old zone name to new zone name in the config and reload it on Panorama or any other better way to do that?

Re: Changing zone name in 100 security policies?

cpainchaud — Mon, 24 Oct 2016 12:19:24 GMT

you can use this script to do it : https://live.paloaltonetworks.com/t5/API-Articles/rules-edit-php-to-manage-edit-export-rules-from-CLI/ta-p/53321

Re: Changing zone name in 100 security policies?

ghostrider — Mon, 24 Oct 2016 15:01:02 GMT

Thanks. I will lookinto this. Do you have script in python? Also Can I do like export file from Panorama and then search and replace the old name of zone with new name and import again into Panorama?

Re: Changing zone name in 100 security policies?

cpainchaud — Mon, 24 Oct 2016 15:12:04 GMT

no python from me 😛

text search and replace would work as long as you dont have any other part of the text file using same text string

Re: Changing zone name in 100 security policies?

ghostrider — Mon, 24 Oct 2016 20:18:26 GMT

Thank you ! Just one last thing, From Panorama what file I need to export, modify and then import

Re: Changing zone name in 100 security policies?

PersonalPA220 — Thu, 28 Jul 2022 20:09:43 GMT

Years after you asked but I thought it was worth mentioning. Presently there is a rename command that looks like it may do the trick:

rename template TEMPLATE-NAME config vsys vsys1 zone OLD-NAME to NEW-NAME

I'm going to do this on about 400 zones tonight, wish me luck.

Re: Changing zone name in 100 security policies?

AndreiYurevich — Mon, 09 Sep 2024 14:04:53 GMT

Have you finished the renaming successfully? I see no "rename" command in panorama cli.

I've just found the following https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleMCAS :

Cause

Attempting to update the zone name in the policy being pushed from Panorama will result in the inability to push that configuration to the device because the zone name is invalid.

Resolution

Create a new zone on the Firewall using the name that the current zone needs to be renamed to and commit the change. This zone will be deleted later but is needed to import the new Panorama config
In Panorama, change the zone name in the policies for the device group containing this device.
Push the new config to the device.
Once it is committed the firewall will NOT pass traffic for this zone until step 5 is completed.
On the Firewall, delete the zone created in step one. Once the zone is deleted rename the old zone with the new name
Commit

Note: Between steps 4 and 5 of this procedure, traffic will not flow through the firewall so it is highly recommended to perform this procedure during off-peak hours.