topic Re: Using scripting mode to modify existing security rules in General Topics

Using scripting mode to modify existing security rules

FrancoisNoel — Fri, 30 Apr 2021 12:46:29 GMT

Hi,

I was wondering if anybody has experience working with the scripting mode in the way I need.

Using the following commands, it is possible to add a single application or service to a rule:

set device-group INTERNAL post-rulebase security rules SEC-APP application [ ssl ]

set device-group INTERNAL post-rulebase security rules WEB-APP service [ http ]

I would like to know if the opposite is feasible: is there a command to remove a single service or a single application from a rule without having to reconfigure the whole rule?

If this is not possible then the only way is to delete the rule and reconfigure it altogether?

Thanks

Re: Using scripting mode to modify existing security rules

BPry — Fri, 30 Apr 2021 13:37:43 GMT

@FrancoisNoel,

This should work perfectly fine, at least on 9.1 and 10.0. You can go through and add a single application or service and remove them as needed without removing the entire entry.

Re: Using scripting mode to modify existing security rules

FrancoisNoel — Fri, 30 Apr 2021 14:11:20 GMT

Thanks for your reply BPry but what is the set command line to remove a single app or service?

Re: Using scripting mode to modify existing security rules

BPry — Fri, 30 Apr 2021 14:19:58 GMT

@FrancoisNoel,

You wouldn't use set to remove an application or service member, you would use delete.

Re: Using scripting mode to modify existing security rules

FrancoisNoel — Fri, 30 Apr 2021 15:07:03 GMT

Thank you very much BPry

Just an FYI.

I first tried this: delete device-group INTERNAL post-rulebase security rules SEC-APP application [ ssl ]

But that didn't work because of the [ ]

I removed the [ ] and all was fine.

Thanks again! Much appreciated!