06-14-2014 05:46 AM
Hi,
I am quite new with Palo Alto and I try to filter disabled rules, so that I only see the enabled rules. I know that a lot of syntax can be found in the monitoring tab, but since enabled/disabled rules are not in it, I cannot find. It is on the Palo alto itself, not Panorama.
06-14-2014 10:06 AM
Could you please test this one on policies query
(disabled eq 'yes' )
06-14-2014 07:52 AM
Hello Johan,
As per my understanding, you will not be able to segregate only disabled rule from the GUI search option. Rather, you can enable "Highlight unused rule" option, it will show you all disabled rule including any other active rule, currently not being used.
But, from the CLI, you can find out all disabled rule by below mentioned command:
admin@DADA> set cli config-output-format set
admin@DADA> configure
Entering configuration mode
admin@DADA# edit rulebase security
[edit rulebase security]
admin@DADA# show | match "disabled yes"
set rulebase security rules test-1 disabled yes >>>>>>>>>>>>>> Rule test-1 is disabled
set rulebase security rules rule2 disabled yes >>>>>>>>>>>>>>> rule2 is also disabled
GUI:
Hope this helps.
Thanks
06-14-2014 08:33 AM
Hi Hulk,
Thanks for your answer, but was not exactly what I meant. The tab 'highlight' is more the used rules since the last reboot, this means enabled and disabled rules. What I try to do is to filter on disabled rules. The reason is that I am busy with a migration from Checkpoint to Palo Alto and have some 200 rules : all the one that I dont need anymore, I disable, but I dont them removed. I try to have the effect that I don't see them anymore in the policy tab within the webui.
thanks and greetz
06-14-2014 10:06 AM
Could you please test this one on policies query
(disabled eq 'yes' )
06-14-2014 10:28 AM
Thanks Panos. That was what I looked for. Is there somewhere some manual for the syntax ?
Greetz,
johan
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!