Unused Services

Reply
L4 Transporter

Unused Services

Is there a way to tell if a service is being used? I am trying to verify that the services the migration tool lists as unused can be deleted. It might be enough to go by what the migration tool says but I usually like to verify it a couple different ways.

L3 Networker

Re: Unused Services

Hi Mate, 

 

Would trust the migration tool. Its checking the xml for occurrances of the named object. If its not in the config it highlights it. 

There's another handy bit of kit called the configurator. If you can get you head around the coding its very useful.

There's one cmd to delete all unused objects. If ye can delete them ye can probably parse them as well. All depends on how many ye have. 10 / 20 can check manually in the xml file yer self. 100's or 1000's maybe try sus out the configurator.. 

 

https://live.paloaltonetworks.com/t5/General-Topics/Pan-Configurator-service-edit-php/m-p/169839#M53...

 

https://github.com/cpainchaud/pan-configurator

 

is open source, as far as I know a pan engineer developed it and maintains it.. 

 

some example of the code below 

Delete unused objects from a config :

    foreach($pan->addressStore->addressObjects() as $object )
      if( $object->countReferences() == 0 )
        $pan->addressStore->remove($object);

Want to know where an object is used ?

    $object = $pan->addressStore->find('H-WebServer4');
    foreach( $object->getReferences() as $ref )
       print $ref->toString()."\n";

 

cheers

 

rob 

Community Manager

Re: Unused Services

and if you want to double-double check you can do a "Global Find" (top right search box or drop-down option on the service) that will search through your entire config and highlight all the places the object appears:

 

global find.pngGlobal Find


Help the community: Like helpful comments and mark solutions
Reaper out
L2 Linker

Re: Unused Services

regarding the solution mentioned above by using the pan-configurator:

 

I recommend the util script which are coming with the pan-configurator:

php service-edit.php in=api://[DEVICE-MGTM-IP] actions=delete 'filter=(object is.unused.recursive)'

 

With this your changes are done against the configuration available on your Palo Alto Networks firewall.

It is also possible to manipulate an offline PAN-OS config file:

php service-edit.php in=[INPUT-FILE].xml out=[OUTPUT-FILE].xml actions=delete 'filter=(object is.unused.recursive)'

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!