topic Re: Filter Policies by Target "Device-Tag" not possible with 9.1.x (Feature Request) in General Topics

Filter Policies by Target "Device-Tag" not possible with 9.1.x (Feature Request)

${userLoginName} — Fri, 09 Jul 2021 17:09:34 GMT

Hi,
since we are changing policy targets from "device name" to "device tag" (device-Tag defined in Panorama > Summary), we still have the need to filter for special devices (device-tags) within the policy sets.

But what I have seen with 9.1.6, filtering policies list by device tag is not possible.

E.g.

(target/devices/entry/@name eq '<device-tag>') - not possible
(tag/member eq '<device-tag>') - not possible

Also filtering for device serial number is not possible anymore within the policy set.

Is there any possiblity to filter for device tags within device-group > policies?
Is is strongly needed for daily business.

Best regards,
Henry

Re: Filter Policies by Target "Device-Tag" not possible with 9.1.x (Feature Request)

kiwi — Thu, 15 Jul 2021 10:48:57 GMT

Hi @${userLoginName} ,

Thank you for sharing ! As far as feature requests go, please check the following blog from not that long ago. It explains the process of how to go about requesting new features:

https://live.paloaltonetworks.com/t5/blogs/how-to-use-palo-alto-networks-new-feature-request/ba-p/409590

Cheers,

-Kiwi.

Re: Filter Policies by Target "Device-Tag" not possible with 9.1.x (Feature Request)

${userLoginName} — Tue, 10 Aug 2021 10:00:41 GMT

Thank you Kiwi,

I know a feature request can be useful, but first I wanted to use the community to find an existing solution, if there exists one.
But it seems, not.

Sometimes I wonder, how features are designed and/or implemented within the WebGUI. 😃

BR,
Henry

Re: Filter Policies by Target "Device-Tag" not possible with 9.1.x (Feature Request)

Remo — Tue, 10 Aug 2021 14:44:31 GMT

Hi @${userLoginName}

Filtering for a device (at least with the serial number) is possible with:

target/devices/entry/@name eq '<serial>'

Actually these policy filter is a filtering in the xml configuration where the policy is stored. Because of that there are some limitations and thats why so far it is only possible to filter by a device serial number.

But to address your requirement I see the following possibilities:

Add actual tags to the policies which you only apply to specific devices. This task you can also automate with a script that checks the policies and adds tags with the same name as your device tags. After that you can filter the policies by these tags
Use a script that does this filtering by device tags (in the script you enter the tag you need and the script then checks which serial this is and searches for policies on this serial) and then shows the policies for example in a html file
The simplified version of a script where you enter the device tag, then the script checks which serial this is/which serials these are, creates the policy filter and adds this string to the clipboard. Then you can simply paste it in the webUI.

... the key for (almost) everything that is not yet possible in the webUI is the API ; )

Re: Filter Policies by Target "Device-Tag" not possible with 9.1.x (Feature Request)

${userLoginName} — Fri, 13 Aug 2021 09:24:49 GMT

Hi @Remo
Thank you for your hints regarding the filtering.

We know that scripting might be a solution, and your possibilites to solve it via script are also valid.

But not for all cases an analysis via script is beneficial.

For now I will accept, that there are DeviceTags, which do not allow full operational benefits in daily business when using them via WebGUI.
E.g. the power of the GlobalSearch in Panorama as well as PolicySet filtering is alomost gone when using DeviceTags with the need of filtering for specific targets, because filtering is not possible anymore. In a very lively policy set it makes it much more harder to analyse/find/adapt policies if this kind of filter is not present anymore.

Best regards,
Henry