bulk disable of security policies through CLI with set commands in a script

cancel
Showing results for 
Search instead for 
Did you mean: 

bulk disable of security policies through CLI with set commands in a script

L1 Bithead

I have 6700 security policies I need to disable in a specific device group. I have them prepped in a text file in set format. CLI is only allowing paste of up to 20 lines at a time. I've tried enabling "cli scripting-mode on" and it still bombs after about 20 lines. Is there a better way to do this please?

2 REPLIES 2

Cyber Elite
Cyber Elite

@aostberg,

Seems like an odd issue, I've definitely done more than 20 lines at a time in an ssh window without issues in the past.

When you're doing anything at this scale I actually wouldn't recommend doing it through the CLI or GUI, I would actually recommend that you complete such a bulk action directly through the XML configuration file itself or though the API. The API has the added benefit that you can quickly and easily verify that the command was actually accepted and the <disabled>yes</disabled> is present in the API 'show' validation result. 

Thanks for your response.  I agree.  something didn't seem right.  The set scripting mode on should have allowed more than 20 lines at a time.  this was on a panorama m-200 appliance.  We ended up using Secure CRT to insert a line send delay at 250ms and a character send delay at 1ms.  Took about 2 hours to process all 6700 set commands but at least the buffer wasn't exceeded every 20 lines and it was a single copy/paste of all 6700.  I hadn't anticipated that issue so only had the 6700 lines prepped as SET commands.  I will explore the use of the API for this type of change before the next time this type of change comes along.  I haven't used the API for anything yet so its still a little greek to me.  

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!