Policy Export

MGoodnow — Tue, 30 Mar 2010 13:52:05 GMT

Hello,

Is there way to export a policy from a PAN device in a read-able format? We are in the process of cutting over a new PAN internet firewall and all the rules had to be created by hand (from the previous vendor model). I'm looking for the ability to take what shows in the webui policy and print it out so that we can more easily review the rules for syntax and other errors - without doing screen shots to PDF. If there is not - can I request a feature request for that ability then. And for objects too. Thanks!

Cheers,

Mike

Re: Policy Export

kbrazil — Tue, 30 Mar 2010 15:29:45 GMT

Hi Mike,

You can run the following command:

show running security-policy (PANOS 3.1)

debug dataplane show security-policy (PANOS 3.0 and below)

This will display the running rule set that can be copy/pasted off to a text file.

You can also view the configuration, including the policy, in a couple different human readable formats:

admin@pa-4000> set cli config-output-format

default default

set set

xml xml

"default" will show the config in normal curly-brace format, while "set" will show the configuration with the set commands. This works when the configuration is shown in Config mode:

admin@pa-4000> set cli config-output-format set

admin@pa-4000> configure

Entering configuration mode

[edit]

admin@pa-4000# edit rulebase security

[edit rulebase security]

admin@pa-4000# show

set rulebase security rules "Allow Facebook Webpage" source any

set rulebase security rules "Allow Facebook Webpage" destination any

set rulebase security rules "Allow Facebook Webpage" service any

set rulebase security rules "Allow Facebook Webpage" application facebook-base

set rulebase security rules "Allow Facebook Webpage" action allow

set rulebase security rules "Allow Facebook Webpage" source-user pancademo\finance

set rulebase security rules "Allow Facebook Webpage" source-user "pancademo\server operators"

set rulebase security rules "Allow Facebook Webpage" option disable-server-response-inspection no

set rulebase security rules "Allow Facebook Webpage" negate-source no

set rulebase security rules "Allow Facebook Webpage" negate-destination no

set rulebase security rules "Allow Facebook Webpage" disabled no

set rulebase security rules "Allow Facebook Webpage" log-start no

set rulebase security rules "Allow Facebook Webpage" log-end yes

set rulebase security rules "Allow Facebook Webpage" from trust

set rulebase security rules "Allow Facebook Webpage" to untrust

set rulebase security rules "Allow Facebook Webpage" profile-setting profiles virus alert-all

set rulebase security rules "Allow Facebook Webpage" profile-setting profiles spyware alert-all

set rulebase security rules "Allow Facebook Webpage" profile-setting profiles vulnerability alert-all

set rulebase security rules "Allow Facebook Webpage" profile-setting profiles file-blocking alert-all

set rulebase security rules "Allow Facebook Webpage" profile-setting profiles data-filtering cc

...

admin@pa-4000# run set cli config-output-format default

[edit rulebase security]

admin@pa-4000# show

security {

rules {

"Allow Facebook Webpage" {

source any;

destination any;

service any;

application facebook-base;

action allow;

source-user [ pancademo\finance "pancademo\server operators"];

option {

disable-server-response-inspection no;

}

negate-source no;

negate-destination no;

disabled no;

log-start no;

log-end yes;

from trust;

to untrust;

profile-setting {

profiles {

virus alert-all;

spyware alert-all;

vulnerability alert-all;

file-blocking alert-all;

data-filtering cc;

}

...

Cheers,

Kelly

Re: Policy Export

MGoodnow — Wed, 19 Jan 2011 14:32:05 GMT

What else would I have to include in the show running security-policy command that will include the Virtual System policy? Thanks!

Mike

Re: Policy Export

kbrazil — Fri, 11 Mar 2011 17:44:44 GMT

Hi Mike,

I'm not sure if this answers your question, but I believe you can see the individual running policies for the VSYS by entering into the VSYS and running the commands above. To enter a VSYS, use the following command:

set system setting target-vsys <vsys name>

Cheers,

Kelly

Re: Policy Export

Sly_Cooper — Thu, 10 May 2018 16:28:06 GMT

How to get the config from Panorama?

Re: Policy Export

JoeAndreini — Thu, 10 May 2018 16:39:28 GMT

Use the same steps to see the policies from the device-group, or see this similar wquestion from earlier this week

https://live.paloaltonetworks.com/t5/General-Topics/Panorama-Security-Rules-Export-in-Human-Readable-Format-Excel/td-p/213293/jump-to/first-unread-message

topic Re: Policy Export in General Topics

Policy Export

Re: Policy Export

Re: Policy Export

Re: Policy Export

Re: Policy Export

Re: Policy Export