topic Re: Filtering the security rules by rule number in General Topics

Filtering the security rules by rule number

ghostrider — Sun, 06 Nov 2016 16:24:24 GMT

Hello Experts

Is there any option to filter or find the security policy through rule number? It seems there is no filter for rule number.

Appreciated your support

Re: Filtering the security rules by rule number

santonic — Mon, 07 Nov 2016 09:45:44 GMT

PA doesn't work with rule numbers. But each rule has to have a name (which can also be just a number). And yes, you can search by rule name in security policy. In fact the search is very powerful, you can search by anything there; IP, zone, object name, rule name...

In which case would you know the rule number but not its name? Cause if you're coming from logs and want to find the matching rule you should have rule name.

Re: Filtering the security rules by rule number

ghostrider — Mon, 07 Nov 2016 12:04:09 GMT

Thanks. Actually reason is funny. Our auditor find the rules to be optimized and they are not sending the rule names, they are sending the rules by number and I want to filter the rules by rule number. Kindly if you can help

Re: Filtering the security rules by rule number

santonic — Mon, 07 Nov 2016 12:24:27 GMT

But where does he get the number from? He has access to WebUI?

And in any case; can't he just forward the name? Plus if you deleted or added any rules before the rule he mentions rule number will be wrong. It's not a reliable info.

I've tried searching by number but it doesn't work, you have to scroll up and down to get to certain rule number.

Re: Filtering the security rules by rule number

ghostrider — Mon, 07 Nov 2016 19:05:58 GMT

Thanks for your help. So security rules numbers changes if adding/deleting rules in between two rules?

Re: Filtering the security rules by rule number

BPry — Mon, 07 Nov 2016 22:06:16 GMT

They aren't really rule numbers, they are simply the line of which the rule falls on the configuration. If you moved the rule or otherwise deleted/added a rule between the time that the rule list was made then the number would no longer be correct.

The rules have rule names, even if you named it 'Rule 387' or just '387' then that is the rule name, the number next to the rule will constantly change with your configuration. Ask your audtor for the actual name of the rule.

Re: Filtering the security rules by rule number

ghostrider — Tue, 08 Nov 2016 06:37:05 GMT

Thank you!