topic Re: Mail alert or report for schedule policy expiry time in firewall in General Topics

Mail alert or report for schedule policy expiry time in firewall

MohammedAsik — Fri, 23 Oct 2020 12:34:32 GMT

Hi Team

In Palo alto firewall whatever the time based policies is going to expire for that we want to configure the mail alerts or reports for example if any rule is going to expire on date of 24 October we should get report or mail alert of those rules by today (2 days before) , how we can achieve this?

Is it possible in palo alto ?

Regards

Mohammed Asik

Re: Mail alert or report for schedule policy expiry time in firewall

reaper — Fri, 23 Oct 2020 13:51:46 GMT

there is no direct correlation between logs that can be forwarded and a schedule set to a policy; the schedule acts as a conditional match inside the security rule, so once the 'end' time is reached, the condition can never be met and the rule won't be hit again

if you need to set rules with a specific end time, it may be a good idea to set a clear description to such rules so they can be easily viewed and removed after they've server their purpose

Re: Mail alert or report for schedule policy expiry time in firewall

MohammedAsik — Fri, 23 Oct 2020 14:24:11 GMT

Hi,

So as per your statement my requirement is not achievable.. right ?

Asik

Re: Mail alert or report for schedule policy expiry time in firewall

BPry — Sat, 24 Oct 2020 16:47:25 GMT

@MohammedAsik,

Not natively. You could put together a script that works in conjunction with the XML-API to pull the schedules that are ending in a specified timeframe and alert on the expiring schedules (or further use the API to find all of the rulebase entries with that schedule specified), but that isn't built-in to PAN-OS.