IPs and ports allowed to a specific host destination

[FrankStamboolian]

Hello everyone!

I was wondering if anyone had any tips or knew of any free tools that I could use to easily gather the allowed IPs and ports for a specific destination IP.

We have a user that would like ot know what traffic is allowed to a specific group of servers.

I'm just trying to avoid manually going through the all policies...I'm new to this environment and palo alto

A Palo Alto Engineer gave me these instructions, but unfortunatley they are for version 8.1 and we are running 8.0.9 =o(

* My favorite is to go to the Objects tab, Addresses, and enter the name or IP address of the host. Then point your mouse at the address object and click on the dropdown arrow that appears. You can then click on Export CSV on the window that comes up. That will tell you everywhere the object is used, and you can filter the CSV for what you need

* If you just want to view the rules where and object is used, you can open the Policies tab, go to Security, in the filter bar at the top enter (destination/member eq 'object name'), and it will show just where that object is used as the destination of a rule. At the bottom there is a button that says PDF/CSV. If you click that it will keep the filter you set and allow you to export either a PDF or a CSV of the rules that match the filter.

Any info would be greatly appreciated!

[OtakarKlier]

Hello,

I would say a free port scanner, or if you have one interanlly, might be able to help you out in this? Otherwise depending on the amount of policies and how they are setup, it could take a while to try and figure out.

Regards,

[reaper]

while the pdf/csv export is a new feature in 8.1, you can still filter your security policy for any object

if set your filter right, you will get all policies where they are used (either as object or ip)

eg.

(destrination/member eq 'serverX') or  (destination/member eq '1.1.1.1') or (etc.)

the only caveat is if you have lots of policies with 'any' or whole subnets (/24) in the destination of yor your server zone, then it becomes a little more complex

[RobinClayton]

You could turn the question arround slightly...

Which IP's and ports have used a particular destiantion IP.

So in traffic monitor just filter by the destination IP.

We have almost 12 months  of full logs backed off to an SQL server so we can look at this historicaly relativly easily.

I guess the question is what are you seekign to achive?

Rob