topic Re: how can we confirm if there is existing firewall rule or not in the policy by filtering by source and destination IP address and port numbers. in General Topics

how can we confirm if there is existing firewall rule or not in the policy by filtering by source and destination IP address and port numbers.

getjamshedkhan — Fri, 09 Jul 2021 10:06:51 GMT

I can find existing firewall rule in the Firewall policy by searching by just source IP address or Just Destination IP address but our Firewall policy rule base is huge and i need to filter it by Source IP and destination IP address (both) and possibly by port number as well , (Just like Checkpoint).

can someone kindly share screenshot of this, that how we can do this in the Palo alto FW.

Thanks

Re: how can we confirm if there is existing firewall rule or not in the policy by filtering by source and destination IP address and port numbers.

BPry — Fri, 09 Jul 2021 14:08:48 GMT

@getjamshedkhan,

So I'll actually do ya one better; the firewall actually has a built in function to test rulebase matches to ensure that traffic is actually going to match outside of just looking through the policies!

If you are using the GUI and a newer PAN-OS release, you can use the 'Test Policy Match' on the bottom right of the policies tab view. This lets you to simulate traffic flows to ensure that you do/don't have a policy already that will match the traffic.

You can also access this feature via the CLI if you aren't running one of the newer releases that exposes this feature in the GUI by building out the traffic flow with the test security-rulebase-match command.

Re: how can we confirm if there is existing firewall rule or not in the policy by filtering by source and destination IP address and port numbers.

Remo — Fri, 09 Jul 2021 19:13:53 GMT

Hi @getjamshedkhan

Just in case you are still interested in filtering the security policy based on multiple criteria. Actually this is possible. You can click on the drop down in the objects to add them to the filter or only to see the syntax to create a filter. For example for filtering based on a specific source object, destination object and service object you can use the following:

(source/member eq 'OBJECTNAME') and (destination/member eq 'OBJECTNAME') and (service/member eq 'SERVICEOBJECTNAME')

Re: how can we confirm if there is existing firewall rule or not in the policy by filtering by source and destination IP address and port numbers.

getjamshedkhan — Fri, 09 Jul 2021 22:53:44 GMT

PREVIEW

Re: how can we confirm if there is existing firewall rule or not in the policy by filtering by source and destination IP address and port numbers.

Remo — Sat, 10 Jul 2021 10:47:05 GMT

@getjamshedkhan what picture would you like to see (as I provided the filter syntax already in the last comment)?

Re: how can we confirm if there is existing firewall rule or not in the policy by filtering by source and destination IP address and port numbers.

Mick_Ball — Sat, 10 Jul 2021 11:33:36 GMT

perhaps a picture of you Mr Remo... ha ha..

here's one...

additional options...

Tags: (tag/member eq 'tagname')

Name: (name contains 'unlocate-block')

Type: (rule-type eq 'intrazone|interzone')

Source Zone: (from/member eq 'zonename')

Source Address: (source/member eq 'any|ip|object')

Source User: (source-user/member eq 'any|username|groupname')

Hip profile: (hip-profiles/member eq 'any|profilename')

Destination Zone: (to/member eq 'zonename')

Destination Address: (destination/member eq 'any|ip|object')

Destination User: (destination-user/member eq 'any|username|groupname')

Application: (application/member eq 'any|applicationname|applicationgroup|applicationfilter')

Service: (service/member eq 'any|servicename|application-default')

URL Category: (category/member eq 'any|categoryname')

This is a destination category, not a URL filtering security profile

stolen from here....

https://live.paloaltonetworks.com/t5/blogs/tips-and-tricks-filtering-the-security-policy/ba-p/163250

and here is @BPry suggestion which gets my vote...

Re: how can we confirm if there is existing firewall rule or not in the policy by filtering by source and destination IP address and port numbers.

Remo — Sat, 10 Jul 2021 12:19:25 GMT

@Mick_Ball : D

(disabled eq 'yes') is missing in that list ... and also one for security profiles and logforwardingprofiles but this I don't know out of my head : P

Re: how can we confirm if there is existing firewall rule or not in the policy by filtering by source and destination IP address and port numbers.

Shehriyar — Sun, 11 Jul 2021 12:26:13 GMT

You can do this from the Policies Tab and then click on Security to show list of Security Policies configured. Then at the bottom right of this page you can see "Test Policy Match" button. By clicking on that you can search the policy as per your exact requirement.

Re: how can we confirm if there is existing firewall rule or not in the policy by filtering by source and destination IP address and port numbers.

cybertrontechnologies.ca — Tue, 24 Feb 2026 00:52:20 GMT

How can we verify the FQDN