Changing zone name in 100 security policies?

[ghostrider]

Hello Experts

I want to change the zone name. There are 100 security policies associated with that zone. How I can do it quickly, like is there any replace pattern command available (like in Juniper) to replace th zone name any where in configuration?

Regards,

GR

[nextgenhappines]

I believe if you just change the zone name under network -> zone, that will automatic update security rules which has that zone applied.

[ghostrider]

Hello

No it is not doing that

[kiwi]

Hi,

Are you doing this directly on a firewall or changing a Panorama Template ?

-Kim.

[ghostrider]

Hello Kiwi

If I do on the firewall directly then next time I push the config from Panorama then it will be deleted. I have to do on Panorama. Is there any way I can manually edit the replace old zone name to new zone name in the config and reload it on Panorama or any other better way to do that?

[cpainchaud]

you can use this script to do it :  https://live.paloaltonetworks.com/t5/API-Articles/rules-edit-php-to-manage-edit-export-rules-from-CL...

[ghostrider]

Thanks. I will lookinto this. Do you have script in python? Also Can I do like export file from Panorama and then search and replace the old name of zone with new name and import again into Panorama?

[cpainchaud · Accepted solution]

no python from me   😛

text search and replace would work as long as you dont have any other part of the text file using same text string 

[ghostrider]

Thank you ! Just one last thing, From Panorama what file I need to export, modify and then import

[PersonalPA220]

Years after you asked but I thought it was worth mentioning. Presently there is a rename command that looks like it may do the trick:

rename template TEMPLATE-NAME config vsys vsys1 zone OLD-NAME to NEW-NAME

I'm going to do this on about 400 zones tonight, wish me luck.

[AndreiYurevich]

Have you finished the renaming successfully? I see no "rename" command in panorama cli.

I've just found the following https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleMCAS :

Cause

Attempting to update the zone name in the policy being pushed from Panorama will result in the inability to push that configuration to the device because the zone name is invalid.

Resolution

1. Create a new zone on the Firewall using the name that the current zone needs to be renamed to and commit the change. This zone will be deleted later but is needed to import the new Panorama config
2. In Panorama, change the zone name in the policies for the device group containing this device.
3. Push the new config to the device.
4. Once it is committed the firewall will NOT pass traffic for this zone until step 5 is completed.
5. On the Firewall, delete the zone created in step one. Once the zone is deleted rename the old zone with the new name
6. Commit

Note: Between steps 4 and 5 of this procedure, traffic will not flow through the firewall so it is highly recommended to perform this procedure during off-peak hours.