topic Re: Default log forwarding and profile group in General Topics

Default log forwarding and profile group

MPoffal — Wed, 14 Jun 2017 21:08:07 GMT

HI,

I've migrated a firewall with 1000 rules, and i need to set one profile of log forwarding and one security profile group. Is possible set this profile for all rules at once, and not one per one.

Marco Poffal Daza

Re: Default log forwarding and profile group

Remo — Wed, 14 Jun 2017 21:52:15 GMT

Hi @MPoffal

At least in the WebUI it is not possible. But you can use the following methods:

PaloAlto Migration Tool
CLI - show all rules, copy the output to notepad, modify or add the log forwarding setting for each rule and past the edited configuration back to CLI
API - write a little script with a foreach-function to add the profile to every existing rule

Re: Default log forwarding and profile group

BPry — Wed, 14 Jun 2017 22:12:55 GMT

@MPoffal,

In my mind there are only two options that actually work well.

1) Modify the XML directly: If you're good with XML then just do it this way, it's by far easier and would take the smallest amount of time.

2) If you don't want to work with XML then the migration tool actually works very well for making bulk changes.

Other options that work but I wouldn't recommend them.

3) API; You likely won't see any mistakes in the script unless you actually save the output to a file and look through it, which doesn't seem like much fun.

4) If you export the name of all of your rules you can simply write a script to go through and set log forwarding and security group profiles that way. It isn't the best option but it would be very easy.

Re: Default log forwarding and profile group

MPoffal — Wed, 21 Jun 2017 18:46:02 GMT

thanks @BPry and @Remo