CLI find security rule, known IP address

[Wbm]

I have one question to engineers Paloalto, why from CLI can't find security rules which include example IP address. What is to difficult create that function?

Why such an advanced device does not have such a simple search. Another thing lack this function in CLI is big problem because i must used GUI.

What for is CLI?

[panos]

Hi,

you can use

test security-policy-match

to find the security rule if you know source ip.

[Wbm]

it doesn't work if your security rule contain field "user"
example:
user cn=net_server ,ou=paloalto,dc=paloalto.org

[panos]

it is working in my lab

test security-policy-match source-user dc\student1 source 192.168.10.17 destination 0.0.0.0  protocol 1

testrule {

        from any;

        source 192.168.10.17;

        source-region none;

        to any;

        destination any;

        destination-region none;

        user dc\student1;

        category any;

        application/service [ youtube-base/any/any/any youtube-safety-m/any/any/

any youtube-uploadin/any/any/any youtube-posting/any/any/any ];

        action deny;

        terminal no;

}

[Wbm]

Yes i know it's working if use dc\nameuser.

Please use domain group Active Directory

example:

user cn=net_server ,ou=paloalto,dc=paloalto.org