Mite seem like a simple question, but it seems you can only clone/duplicate the security rules within the same policy you cloned/copied it from. Im trying to create a new device group and use existing security rules from an existing device group without having to rewrite the same security rules in the new device group. Thank You.
There are a few ways you might do this.
You can use the panxapi command line program from the PAN-perl package on DevCenter and get/show (-g/-s) the source device group xpath then set (-S) the XML into the new device group. Also clone (--clone) might be able to do this in one step.
You could also use the load config partial CLI configuration mode command. The challenging part may be figuring out the xpaths. However, assuming you want to copy post-rulebase security rule1 from test-dg to dg2, the following should work. Hopefully that will get you started and you can adjust the xpaths to do what you need to do.
admin@Panorama# load config partial from running-config.xml from-xpath /config/devices/entry/device-group/entry[@name='test-dg']/post-rulebase/security/rules/entry[@name='rule1'] to-xpath /config/devices/entry/device-group/entry[@name='dg2']/post-rulebase/security/rules mode append
Config loaded from running-config.xml
This had been a known limit which is addressed in 5.0 to an extent.
5.0 offers option to setup shared policies
– This new feature adds the ability for Panorama admins to add an additional layer of pre and post rules that will be applied to all Device Groups managed by the Panorama instance. You can also set up admin access control options, so the rules are only editable by privileged admins and cannot be changed by Device Group admins. Another new feature for Shared Policy is the Shared Objects Take Precedence option, which is located in Panorama > Setup > Management > General Settings. When this option is unchecked, device groups override corresponding objects of the same name from a shared location. If the option is checked, device group objects cannot override corresponding objects of the same name from a shared location and any device group object with the same name as a shared object will be discarded. To access this feature, select the Policies tab and then select Shared from the Device Group drop-down.
With XML editor it may be possible to copy existing ruleset.
Please mark it as 'Correct answer or helpful' if you
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!