topic Re: How-to delete a policy-based forwarding rule from CLI in General Topics

How-to delete a policy-based forwarding rule from CLI

scott.woody — Thu, 19 Apr 2018 15:36:43 GMT

I'm trying to find the correct syntax to delete a policy based forwarding rule from a PA firewall via the CLI. having a really hard time formulating this from the CLI reference.

How would i do this by referencing the ID.

also, this firewall is managed as part of a Panorama template. would i need to use the 'override deviceconfig system' command beforehand?

Thank you.

-SW

Re: How-to delete a policy-based forwarding rule from CLI

gwesson — Fri, 20 Apr 2018 22:07:20 GMT

If the rule in question is not pushed by Panorama, you can delete it locally without issue:

> configure

# delete rulebase security rules RuleNameHere

# commit

If the rule was pushed by Panorama, it can be deleted on Panorama via CLI as well. The syntax gets more complex because you need to specify the device group and specify the rule type (pre-rule or post-rule).

> configure

# delete device-group DGNameHere pre-rulebase security rules RuleNameHere

# commit

I am fairly sure there is a way to delete Panorama-pushed rules on the firewall (if the Panorama admin allows that), but can't find it offhand.

Re: How-to delete a policy-based forwarding rule from CLI

BPry — Sun, 22 Apr 2018 03:26:10 GMT

@scott.woody,

@gwesson gave you the right commands but actually used the securtiy rulebase. You would want to modify that to 'rulebase pbf' instead to actually work with the pbf rules. The rest of the examples given stays the same.

Re: How-to delete a policy-based forwarding rule from CLI

Remo — Sun, 22 Apr 2018 10:40:23 GMT

@scott.woody

Locally you cannot override a policy based forwarding rule when it is configured on panorama. So to delete this rule you have to use the commands mentionned by @gwesson and @BPry on panorama. If the rule is configured on the panorama in post rulebase, then you probably could create a local rule which makes the panorama rule unnecessary and hides it so ti will not be applied anymore.

The override command you mentionned is only for template configurations and not for configurations from device groups.