概述 本文介绍了如何在CLI（命令行界面）中查看、创建和删除安全策略。   详细介绍 从CLI创建一个新的安全策略： > configure （按回车键） # set rulebase security rules <name> from <source zone> to <destination zone> destination <ip> application <application> service <any/application-default/service name> action <allow/deny> （按回车键） # exit   例子： # set rulebase security rules Generic-Security from Outside-L3 to Inside-L3 destination 63.63.63.63 application web-browsing service application-default action allow （按回车键） 注意：对于所有CLI命令的输入帮助，使用"?"或[tab]来获得可用命令的列表。   从CLI查看Palo Alto Networks安全策略： > show running security-policy   Rule       From         Source        To           Dest.           User                Proto Port Range Application  Action ---------- ------------ ------------- ------------ --------------- ------------------- ----- ---------- ------------ ------ Doms DLP   untrust-vwir 10.16.0.92    Untrust-vwir any             any                 any   any        any          allow            trust-vwire                trust-vwire   rule4      untrust-vwir any          untrust-vwir  10.16.0.92      any                 any   any        any          allow            trust-vwire                trust-vwire   rule3      trust-vwire  any          untrust-vwir  any             any                 any   any        any          allow     下面的命令将输出整个配置： > show config running   设定格式输出为set： > set cli config-output-format set   > configure Entering configuration mode [edit]   # edit rulebase security [edit rulebase security]   # show set rulebase security rules rashi from trust-vwire set rulebase security rules rashi from untrust-vwire set rulebase security rules rashi to trust-vwire set rulebase security rules rashi to untrust-vwire set rulebase security rules rashi source 10.16.0.21 set rulebase security rules rashi destination any set rulebase security rules rashi service any set rulebase security rules rashi application adobe-meeting-remote-control set rulebase security rules rashi application adobe-meeting set rulebase security rules rashi application adobe-online-office set rulebase security rules rashi action deny set rulebase security rules rashi source-user any set rulebase security rules rashi option disable-server-response-inspection no set rulebase security rules rashi negate-source no set rulebase security rules rashi negate-destination no set rulebase security rules rashi disabled yes set rulebase security rules rashi log-start no set rulebase security rules rashi log-end yes   切换为默认输出格式： 从配置模式： # run set cli config-output-format default   [edit rulebase security] # show security {   rules {     rashi {       from [ trust-vwire untrust-vwire];       to [ trust-vwire untrust-vwire];       source 10.16.0.21;       destination any;       service any;       application [ adobe-meeting-remote-control adobe-meeting adobe-online-office];       action deny;       source-user any;       option {         disable-server-response-inspection no;       }       negate-source no;       negate-destination no;       disabled yes;       log-start no;       log-end yes;       profile-setting {         profiles {           file-blocking rashi_file_alert;           data-filtering rashi_dlp;         }   使用XML格式查看配置： 从配置模式： # run set cli config-output-format xml   [edit rulebase security] # show <response status="success" code="19">   <result total-count="1" count="1">     <security>       <rules>         <entry name="rashi">           <from>             <member>trust-vwire</member>             <member>untrust-vwire</member>           </from>           <to>             <member>trust-vwire</member>             <member>untrust-vwire</member>           </to>           <source>             <member>10.16.0.21</member>           </source>           <destination>             <member>any</member>           </destination>           <service>             <member>any</member>           </service>           <application>             <member>adobe-meeting-remote-control</member>             <member>adobe-meeting</member>             <member>adobe-online-office</member>           </application>           <action>deny</action>           <source-user>             <member>any</member>           </source-user>           <option>             <disable-server-response-inspection>no</disable-server-response-inspection>           </option>           <negate-source>no</negate-source>           <negate-destination>no</negate-destination>           <disabled>yes</disabled>           <log-start>no</log-start>           <log-end>yes</log-end>           <profile-setting>             <profiles>               <file-blocking>                 <member>rashi_file_alert</member>               </file-blocking>               <data-filtering>   另外，如果你想用更短的方式在配置模式下查看和删除安全规则，你可以使用这两条命令： 查找一条规则： show rulebase security rules <rulename>   删除一条规则： delete rulebase security rules <rulename>