topic Re: Unused Services in General Topics

Unused Services

jdprovine — Tue, 21 Nov 2017 16:48:12 GMT

Is there a way to tell if a service is being used? I am trying to verify that the services the migration tool lists as unused can be deleted. It might be enough to go by what the migration tool says but I usually like to verify it a couple different ways.

Re: Unused Services

DonohoeRobert — Tue, 21 Nov 2017 22:48:57 GMT

Hi Mate,

Would trust the migration tool. Its checking the xml for occurrances of the named object. If its not in the config it highlights it.

There's another handy bit of kit called the configurator. If you can get you head around the coding its very useful.

There's one cmd to delete all unused objects. If ye can delete them ye can probably parse them as well. All depends on how many ye have. 10 / 20 can check manually in the xml file yer self. 100's or 1000's maybe try sus out the configurator..

https://live.paloaltonetworks.com/t5/General-Topics/Pan-Configurator-service-edit-php/m-p/169839#M53921

https://github.com/cpainchaud/pan-configurator

is open source, as far as I know a pan engineer developed it and maintains it..

some example of the code below

Delete unused objects from a config :

    foreach($pan->addressStore->addressObjects() as $object )
      if( $object->countReferences() == 0 )
        $pan->addressStore->remove($object);

Want to know where an object is used ?

    $object = $pan->addressStore->find('H-WebServer4');
    foreach( $object->getReferences() as $ref )
       print $ref->toString()."\n";

cheers

rob

Re: Unused Services

reaper — Wed, 22 Nov 2017 08:25:24 GMT

and if you want to double-double check you can do a "Global Find" (top right search box or drop-down option on the service) that will search through your entire config and highlight all the places the object appears:

Global Find

Re: Unused Services

swaschkut — Mon, 27 Nov 2017 15:21:02 GMT

regarding the solution mentioned above by using the pan-configurator:

I recommend the util script which are coming with the pan-configurator:

php service-edit.php in=api://[DEVICE-MGTM-IP] actions=delete 'filter=(object is.unused.recursive)'

With this your changes are done against the configuration available on your Palo Alto Networks firewall.

It is also possible to manipulate an offline PAN-OS config file:

php service-edit.php in=[INPUT-FILE].xml out=[OUTPUT-FILE].xml actions=delete 'filter=(object is.unused.recursive)'