topic Re: How can I filter disabled rules in the 'policies'-tab in General Topics

How can I filter disabled rules in the 'policies'-tab

johan.boeckx — Sat, 14 Jun 2014 12:46:05 GMT

Hi,

I am quite new with Palo Alto and I try to filter disabled rules, so that I only see the enabled rules. I know that a lot of syntax can be found in the monitoring tab, but since enabled/disabled rules are not in it, I cannot find. It is on the Palo alto itself, not Panorama.

Re: How can I filter disabled rules in the 'policies'-tab

HULK — Sat, 14 Jun 2014 14:52:49 GMT

Hello Johan,

As per my understanding, you will not be able to segregate only disabled rule from the GUI search option. Rather, you can enable "Highlight unused rule" option, it will show you all disabled rule including any other active rule, currently not being used.

But, from the CLI, you can find out all disabled rule by below mentioned command:

admin@DADA> set cli config-output-format set

admin@DADA> configure

Entering configuration mode

admin@DADA# edit rulebase security

[edit rulebase security]

admin@DADA# show | match "disabled yes"

set rulebase security rules test-1 disabled yes >>>>>>>>>>>>>> Rule test-1 is disabled

set rulebase security rules rule2 disabled yes >>>>>>>>>>>>>>> rule2 is also disabled

GUI:

Hope this helps.

Thanks

Re: How can I filter disabled rules in the 'policies'-tab

johan.boeckx — Sat, 14 Jun 2014 15:33:53 GMT

Hi Hulk,

Thanks for your answer, but was not exactly what I meant. The tab 'highlight' is more the used rules since the last reboot, this means enabled and disabled rules. What I try to do is to filter on disabled rules. The reason is that I am busy with a migration from Checkpoint to Palo Alto and have some 200 rules : all the one that I dont need anymore, I disable, but I dont them removed. I try to have the effect that I don't see them anymore in the policy tab within the webui.

thanks and greetz

Re: How can I filter disabled rules in the 'policies'-tab

Retired Member — Sat, 14 Jun 2014 17:06:08 GMT

Could you please test this one on policies query

(disabled eq 'yes' )

Re: How can I filter disabled rules in the 'policies'-tab

johan.boeckx — Sat, 14 Jun 2014 17:28:33 GMT

Thanks Panos. That was what I looked for. Is there somewhere some manual for the syntax ?

Greetz,

johan

Re: How can I filter disabled rules in the 'policies'-tab

Retired Member — Sat, 14 Jun 2014 17:42:54 GMT

I don't think there is one but at least I don't have....

Regards.

Re: How can I filter disabled rules in the 'policies'-tab

NLughmani — Mon, 16 Jun 2014 07:40:14 GMT

one other way I found helpful is make use of tags when defining rules and then later on you use these tags in your filter

Re: How can I filter disabled rules in the 'policies'-tab

timedout — Sat, 26 Oct 2019 06:26:29 GMT

If you do tag your rules you can then use the below searches to see only disabled, or only enabled. Note that there is no text between the apostrophes, which represents the 'none' in the tag column, that you cant usually filter on unless you use tags.

I tagged all enabled rules and didn't tag the disabled:

# Show Disabled

(tag/member eq '')

# Show Enabled

(tag/member neq '')

Re: How can I filter disabled rules in the 'policies'-tab

rolinger — Fri, 26 Mar 2021 18:37:39 GMT

This solution isn't working for me.

If I do: (disabled eq 'yes') - it will show me all 80 disabled rules.

But if I do (disabled eq 'no') - it shows me just 12 out of 160 active rules - one of which is a local rule, the other 11 are Pano rules. Like the OP, how do I weed out "disabled" rules? Is there another method?

Re: How can I filter disabled rules in the 'policies'-tab

FrancoisNoel — Fri, 17 Dec 2021 15:02:19 GMT

Same here, I find this command is buggy