How-to delete a policy-based forwarding rule from CLI

cancel
Showing results for 
Search instead for 
Did you mean: 

How-to delete a policy-based forwarding rule from CLI

L0 Member

I'm trying to find the correct syntax to delete a policy based forwarding rule from a PA firewall via the CLI.  having a really hard time formulating this from the CLI reference.

 

How would i do this by referencing the ID.

 

also, this firewall is managed as part of a Panorama template.  would i need to use the 'override deviceconfig system' command beforehand?

Thank you.

-SW

 

1 ACCEPTED SOLUTION

Accepted Solutions

@scott.woody

Locally you cannot override a policy based forwarding rule when it is configured on panorama. So to delete this rule you have to use the commands mentionned by @gwesson and @BPry on panorama. If the rule is configured on the panorama in post rulebase, then you probably could create a local rule which makes the panorama rule unnecessary and hides it so ti will not be applied anymore. 

The override command you mentionned is only for template configurations and not for configurations from device groups.

View solution in original post

3 REPLIES 3

L7 Applicator

If the rule in question is not pushed by Panorama, you can delete it locally without issue:

> configure

# delete rulebase security rules RuleNameHere

# commit

 

 

If the rule was pushed by Panorama, it can be deleted on Panorama via CLI as well. The syntax gets more complex because you need to specify the device group and specify the rule type (pre-rule or post-rule).

> configure

# delete device-group DGNameHere pre-rulebase security rules RuleNameHere

# commit

 

I am fairly sure there is a way to delete Panorama-pushed rules on the firewall (if the Panorama admin allows that), but can't find it offhand.

 

@scott.woody,

@gwesson gave you the right commands but actually used the securtiy rulebase. You would want to modify that to 'rulebase pbf' instead to actually work with the pbf rules. The rest of the examples given stays the same. 

@scott.woody

Locally you cannot override a policy based forwarding rule when it is configured on panorama. So to delete this rule you have to use the commands mentionned by @gwesson and @BPry on panorama. If the rule is configured on the panorama in post rulebase, then you probably could create a local rule which makes the panorama rule unnecessary and hides it so ti will not be applied anymore. 

The override command you mentionned is only for template configurations and not for configurations from device groups.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!