Exporting all the rules and sub rules

[AWongCA]

I have been tasked with exporting all the rules from our Palo Altos for monthly review purposes.

Panorama has shared rules as well as rules in each device group. Our firewalls have rules on them as well.

• Support suggests using the PDF/CSV option on the shared rules. We have 10+ shared and sub device groups, and 20+ PA220s.  Obviously this will work and will be a fantastic mess of CSV files but it will be good data. Tedious and mistake prone. 
• I have looked into the API approach https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNutCAG . I have a feeling this may be outdated with version 10 software. 
• I have tried to convert the XML backup files using a powershell script I found here which worked but then I was informed we need to include the NAT rules as well

[JayGolf]

Hi @AWongCA ,

thanks for sharing! sorting through csv files can be tedious. You should be able to use XML API.

[AWongCA]

Just to provide an update - support concluded the best way to export this information would be to manually export the security and NAT rules as CSV from every firewall GUI rather than going through Panorama. 

Logic being the firewall has the final set of all the rules including device specific rules so that will be the most "clean"

Going through API - they were able to confirm the browser shouldn't output anything useful and one needs to go through Excel to potentially import the data.  Since our setup has a self-signed certificate that Excel does not allow bypassing it seems like a dead end there. 

Also if you have any scripts or converters please share.  I keep running into the post that says do a search you will find 4 or 5 and I can tell you it looks like the converter written in Python for PAN-OS 7 doesn't work with OS 10 configs.  There is another Python one that seems to only work with device configs.