is it possible to export firewall rule only??

[willstech]

Hi all.

Is it possible to export security policy with CSV, PDF or txt format?? I can’t find any export menu only for firewall rule.

If it is possible, is it able to modify that exported firewall rule??

And then is it possible to import modified firewall rule to PA device??

Customer wants to review their firewall rule with readable file format.

Of course I know that PA supports export for configuration file on the Device TAB but it is included all of configure information.

I just want to know that how to export firewall policy only with CSV, PDF or etc.

Thanks,

Eugene.

[mderksen]

Hi,

This is not possible with the webgui. The only way you can modify and import the configuration from the webgui is the export and import function in the device tab.

What you might try is the CLI.

Within the CLI set the output format to set (set cli config-output-format set) and then go into the configure mode. When you do an 'show rulebase' it will show you the rulebase in a readable format.

Marcel

[solsen]

Hi Eugene!

I have a utility that will extract most of the configuration of the box into an Excel documnets with multiple sheets.

It will give you rulebase, custom apps, application groups, application filters , services etc.

Email me on staffan@radpoint.se and I will send you a copy and you can try it to see if it does what you are looking for.

Best regards Staffan

[choff123]

so, exports of security policies are still not available?

i really hate tring to audit 150+ rules in the web gui.

[mikand]

I think solsens excel-utility can be handy for this.

Otherwise you can export the running-config.xml and run it through sed or such.

The interresting stuff is between <rulebase> and </rulebase> (to get not only the rules but also any profiles or such) and if you want just the security rules you go for the stuff between <security> and </security>.

Another method (already described), specially if you are not friendly to xml, is to use cli and enable set-commands and then just do a "show running-config" (which you then run through sed to only keep the interresting stuff).

[choff123]

so, its roll your own then .. ok, thanks mikand.

btw: i dont see 'solsens excel-utility' on this forum or google.

[mikand]

I think you must email him to get a copy, while you email him - ask if he cant publish he utility online? 🙂

[choff123]

do you have an address?

I just stared my audit via the giu :|, this is going to be painful

[mikand]

His email is posted in the message he posted earlier: https://live.paloaltonetworks.com/message/6354#6354

[choff123]

sry, thanks

[licenselu]

Hello,

This message is targeted to PA team...

It would be nice to provide an official tools to export firewall rules, NAT rules, Decryption rules in HTML, PDF format.

Checkpoint has an official tools called Web Visualization tools.

PA, please help us...

Regards,

Hedi

[slawek.kunach]

Seconded!

[James]

Did you try this already?

Thanks

James

[licenselu]

Hello,

I tried the Excel using XML API method.

It works BUT it's not friendly as the Checkpoint Tools...

Regards,

Hedi

[dwilliamsonami]

Just an FYI to all.  In the instructions for Excel using XML API it references Using the XML API in the paragraph in step 2.  In the instructions on Using the XML API, there is a typo in 01. of Key Generation https://hostname/esp/restapi.esp?type=keygen&user=username&passwordpassword=password.  It should be &password=password.