Assigning security profile to multiple security rules

[tirexxerit]

Hi,

  when you have 100-200 security rule and need to assign a threat security profile to all the rules, what do you do?

Does anyone know an easy way of doing it? I can either script it via XML API but there should be an easier way I think.

thanks.

[OtakarKlier]

Hello,

If they already have assigned a Group or Profile, you can just modify it, that way it will get applied. If you currently do not have any applied and need to apply one you can either do it by the XML method you mentioned, or I think there could be a way to script it via the API, but thats an area where I dont delve into. But I'm sure others may have another method.

Regards,

[tirexxerit]

No profile is attached actually and need to assign group profile to multiple firewalls.

There is a nice feature on URL filtering profile for example. You choose the action and say apply the action to all categories

which is quite handy but couldn't see such for security rules yet. Maybe on the roadmap.

If there is no built-in method, then I need to look into API.

thanks.

[OtakarKlier]

Or Panorama if you have it.

[tirexxerit]

I don't recall that panorama has such feature. If you don't mean assigning to device group and pushing it to multiple devices.

[OtakarKlier]

Sorry I didnt specify. If you have Panorama, you could make all the changes there and push those changes out to the different managed firewalls. However you would still need to assign the profiles to the different policies.

[JoeAndreini]

I've done this two ways, depending on how many times it will need to be done.

The way i've done it when tehre are many firewalls or device groups to update is via scripting and teh XML API - I pull the policies with powershell, iterate through the policies adding the profiles or profile group, then push them back to teh firewall or panorama.  it's pretty quick.

If there is only one or two to do:

log into the CLI

issue the command "set cli config-output-format set" so that when you view the configuration it give set commands

enter edit mode

"show vsys vsys1 rulebase security | match 'action allow'" - this should give you a "list" of your rules, copy that to a text editor, so you can repalce "action allow" with 'profile-setting group "<your profile group>"' or the appropriate command to set the profile(s) you want.

paste the commands back into the firewall - be aware the buffer is relatively small, take 10-15 lines at a time

[BPry]

@tirexxerit,

In addition to the method already specified by @JoeAndreini:

1) You could use Expedition (The migration tool) and do this easily. Depending on experiance with the API or modifying the XML this would actually be my preffered method.  

2) You could modify the XML directly and simply look in every entry within <security> and ensure that it has a <profile-setting> element. If you're comfortable with XML this is my preffered method. 

API scripts are great but you have to be very careful that it doesn't actually give a bad result on the rules. Making a script that accounts for these expections with the API can be a bit of a pain. 

[Remo]

---

@JoeAndreini wrote:

be aware the buffer is relatively small, take 10-15 lines at a time

---

... or if you're using a SSH client that has this feature, set a delay of 150ms between the commands

[JoeAndreini]

or use scripting-mode : set cli scripting-mode on

I never remember this exact command and often just paste 20 lines at a time rather than google it..