Edit Security Policies simultaneously

[m.hassan96]

Hi All,

I was wondering how can I edit all the security policy rules simultaneously If I want to make any change in specific field. For example I have 80 security rules and I want to change Source Address of each rule so how can I edit this field for all the 80 rules? Do I have to edit each rule individually or is there an easy way to do it? Any help would be appreciated

[vsys_remo]

Hi @m.hassan96 

The WebUI does not offer a multi edit feature. But such tasks you can do easily on the CLI. When you set the output mode to "set" (set cli config-output-format set) you can display the rules you need (show rulebase security rules | match OBJECTNAME). Then copy this output to a texteditor, replace the old object with the new one and paste the lines to the CLI.

[OtakarKlier]

Hello,

You can also download the XML config, modify it, then upload it. Just be carefull.

Cheers!

[BPry]

@m.hassan96,

XML is my preferred way of modifying the configuration as you can put the XML file itself directly into source control. As @OtakarKlier  mentioned you just have to ensure that you don't mess up the formatting, however the validation process (either ran seperatly when loading the config or during the commit process) should catch any issues you may make. The firewall also won't actually load a malformed XML file. 

[OGMaverick]

Make sure to replace it with an object if possible instead of an address so you only have to change it in 1 place on the future!

[El-ahrairah]

Multi edit is a function people have been begging for since version 4!

Ironically the function has existed for ages in the Migration Tool and now Expedition.

Expedition is relatively easy to spin up. You can then connect your firewall to it to import the policy and perform your multi edits here. Then Expedition can push the policy back to the firewall via API.

Other than this, you're only options are ones already mentioned...

- Mass CLI commands probably written up in a spreadsheet

- Output the XML and manually edit it (highly suseptible to corruption)

- API automation (Basically what Expedition does for you).

EDIT: Forgot to include the link!

https://live.paloaltonetworks.com/t5/Expedition-Migration-Tool/ct-p/migration_tool

[jeremy.larsen]

I recommend using the "rename" command in the CLI.  It's quick, dirty and easy.  Here is a snippet from one of my other posts to rename rules.  You can just adapt this to "source IP" or whatever you are doing instead the the "rule name" in this example.

-----------------------

If you have a list of names (or just pull them from the config in the "set" formatting), you could probably script something out pretty quick with the "rename" statement in the cli.

Example from Panorama:

rename device-group grpGlobal pre-rulebase security rules grpGlobal-BlockKnownMalicious to grpWhateverYouWant

Example directly on Firewall:

rename rulebase security rules toBeChanged to newRuleName

[ethiSEC]

PAN Configurator is a simple tool you can use to perform bulk edits, it's available from here:

https://github.com/cpainchaud/pan-configurator/tree/master/utils

It's quite easy to use on Mac, Linux or Windows.

Jason

[BatD]

@m.hassan96 

It can be easily do using the "multiedit" feature of Expedition migration tool 

[swaschkut]

Sorry for updating this.

Please be aware that pan-configurator was stopped, but continued under a new name and repository:
https://github.com/PaloAltoNetworks/pan-os-php

it has the same features set from pan-configurator, but already improved and extended.