How-to delete a policy-based forwarding rule from CLI

[scott.woody]

I'm trying to find the correct syntax to delete a policy based forwarding rule from a PA firewall via the CLI.  having a really hard time formulating this from the CLI reference.

How would i do this by referencing the ID.

also, this firewall is managed as part of a Panorama template.  would i need to use the 'override deviceconfig system' command beforehand?

Thank you.

-SW

[gwesson]

If the rule in question is not pushed by Panorama, you can delete it locally without issue:

> configure

# delete rulebase security rules RuleNameHere

# commit

If the rule was pushed by Panorama, it can be deleted on Panorama via CLI as well. The syntax gets more complex because you need to specify the device group and specify the rule type (pre-rule or post-rule).

> configure

# delete device-group DGNameHere pre-rulebase security rules RuleNameHere

# commit

I am fairly sure there is a way to delete Panorama-pushed rules on the firewall (if the Panorama admin allows that), but can't find it offhand.

[BPry]

@scott.woody,

@gwesson gave you the right commands but actually used the securtiy rulebase. You would want to modify that to 'rulebase pbf' instead to actually work with the pbf rules. The rest of the examples given stays the same. 

[Remo · Accepted solution]

@scott.woody

Locally you cannot override a policy based forwarding rule when it is configured on panorama. So to delete this rule you have to use the commands mentionned by @gwesson and @BPry on panorama. If the rule is configured on the panorama in post rulebase, then you probably could create a local rule which makes the panorama rule unnecessary and hides it so ti will not be applied anymore. 

The override command you mentionned is only for template configurations and not for configurations from device groups.