List all deny rules from cli

Showing results for 
Show  only  | Search instead for 
Did you mean: 

List all deny rules from cli

L1 Bithead

I have to list all deny rules (from cli)

The following command "show running security-policy | match index " list all security rules by name

For example:

"AllowBrach1IN; index: 1" {


What I want is:

- deny INBOUND traffic rules only but regarding entire subnets (those having CIDR as their destination

Is there any way to filter out that type of information?




Cyber Elite
Cyber Elite

Give this a shot:


reaper@PANgurus> set cli config-output-format set
reaper@PANgurus> configure
Entering configuration mode
[edit]                                                                             reaper@PANgurus# show rulebase security | match drop
Tom Piens
PANgurus - SASE and Strata specialist; (co)managed services, VAR and consultancy

thanks a lot but it seems to me that show rulebase command is missing

here's the putput I get if I type show

> admins Show active administrators
> api-key-expiration-ts Shows the time before which any API keys would be invalid
> arp Show ARP information
> auth auth state variables
> authentication Show authentication related information
> chassis Chassis state and information
> chassis-ready Show whether dataplane has a running policy
> cli Show CLI properties
> clock Show system date and time
> commit-locks Show list of commit locks
> config Show configuration
> config-locks Show list of config locks
> counter Show system counter information
> device-certificate Show device certificate
> dhcp Show DHCP data
> dns-proxy Show DNS Proxy information
> dos-block-table Show hardware ACL or Block-ip table
> dos-protection Show DoS protection related information
> global-protect Show settings for GlobalProtect
> global-protect-gateway Show GlobalProtect gateway run-time objects
> global-protect-mdm Show settings for GlobalProtect MDM
> global-protect-portal Show gloabl protect poral user session info
> global-protect-satellite Show GlobalProtect satellite run-time objects
> gtp Show GTP information
> high-availability Show high-availability information
> hsm Show HSM information
> interface Show interface information
> jobs Show management server jobs
> lacp Show LACP state
> license-token-files Show license token files for manual license deactivation
> lldp Show LLDP state
> location Show geographic location
> log Show logs related information
> log-collector Show log-collector information
> logging-status Show logging status and info
> mac Show MAC address information
> management-clients Show internal management server clients
> max-num-images Show maximum number of software or content images
> neighbor Show IPv6 neighbor information
> netstat Print network connections and statistics
> ntp Show NTP synchronization state
> object Show IP address object
> obsolete-disabled-ssl-exclusions Show disabled predefined ssl-decrypt exclusions not present in the installed content
> operational-mode Show device operational mode setting
> oss-license show license for open source packages
> panorama-certificates Show panorama certificate list
> panorama-status Show panorama connection status
> parent-info show parent info
> pbf Show policy-based-forwarding run-time information
> plugins Request information of plugins
> pppoe Show pppoe statistics
> predefined Show predefined config
> qos Show QoS run-time information
> query Show query jobs
> report Show report jobs
> resource Show resource limits information
> routing Show routing run-time objects
> rule-hit-count Show policy rule hit-count information
> running Show running operational parameters
> sctp Show SCTP information
> session Show session information
> sp-metadata sp-metadata
> ssh-fingerprints Show management ssh public key fingerprints
> ssl-conn-on-cert Show setting for ssl fail connection on cert
> sslmgr-store Show sslmgr dynamic configuration
> statistics Show device statistics
> syslogng-ssl-conn-validation Show syslog-ng ssl connection validation settings
> system Show system state and information
> threat Show Threat id descriptions
> url-cloud Show URL cloud info
> user Show user identification information
> virtual-wire Show virtual-wire information
> vlan Show vlan information
> vm-monitor Show VM monitoring information
> vpn Show IKE/IPSec VPN run-time objects
> wildfire Show wildfire information
> zone-protection Show zone protection runtime statistics


Hi @jls3j999 ,


"show rulebase security" is command in configuration mode, while you are still in user mode.

If you look again the instructions from @reaper you will see that before executing the "show" command you need to enter configuration mode by typing "configure"

@jls3j999 please follow all the steps, else it won't work 😉


Change the cli output mode to set commands

Go into configure mode

Run the show command

Tom Piens
PANgurus - SASE and Strata specialist; (co)managed services, VAR and consultancy
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!