Default log forwarding and profile group

[MPoffal]

HI,

I've migrated a firewall with 1000 rules, and i need to set one profile of log forwarding and one security profile group. Is possible set this profile for all rules at once, and not one per one.

Marco Poffal Daza

[Remo]

Hi @MPoffal

At least in the WebUI it is not possible. But you can use the following methods:

• PaloAlto Migration Tool
• CLI - show all rules, copy the output to notepad, modify or add the log forwarding setting for each rule and past the edited configuration back to CLI
• API - write a little script with a foreach-function to add the profile to every existing rule

[BPry]

@MPoffal,

In my mind there are only two options that actually work well. 

1) Modify the XML directly: If you're good with XML then just do it this way, it's by far easier and would take the smallest amount of time. 

2) If you don't want to work with XML then the migration tool actually works very well for making bulk changes. 

Other options that work but I wouldn't recommend them. 

3) API; You likely won't see any mistakes in the script unless you actually save the output to a file and look through it, which doesn't seem like much fun. 

4) If you export the name of all of your rules you can simply write a script to go through and set  log forwarding and security group profiles that way. It isn't the best option but it would be very easy. 

[MPoffal]

thanks @BPry and @Remo