List all deny rules from cli

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

List all deny rules from cli

L1 Bithead

I have to list all deny rules (from cli)

The following command "show running security-policy | match index " list all security rules by name

For example:

"AllowBrach1IN; index: 1" {

....etc

What I want is:

- deny INBOUND traffic rules only but regarding entire subnets (those having CIDR as their destination ...like 192.168.1.0/24..etc)

Is there any way to filter out that type of information?

Thanks,

 

14 REPLIES 14

Cyber Elite
Cyber Elite

Give this a shot:

 

reaper@PANgurus> set cli config-output-format set
reaper@PANgurus> configure
Entering configuration mode
[edit]                                                                             reaper@PANgurus# show rulebase security | match drop
Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

thanks a lot but it seems to me that show rulebase command is missing

here's the putput I get if I type show

> admins Show active administrators
> api-key-expiration-ts Shows the time before which any API keys would be invalid
> arp Show ARP information
> auth auth state variables
> authentication Show authentication related information
> chassis Chassis state and information
> chassis-ready Show whether dataplane has a running policy
> cli Show CLI properties
> clock Show system date and time
> commit-locks Show list of commit locks
> config Show configuration
> config-locks Show list of config locks
> counter Show system counter information
> device-certificate Show device certificate
> dhcp Show DHCP data
> dns-proxy Show DNS Proxy information
> dos-block-table Show hardware ACL or Block-ip table
> dos-protection Show DoS protection related information
> global-protect Show settings for GlobalProtect
> global-protect-gateway Show GlobalProtect gateway run-time objects
> global-protect-mdm Show settings for GlobalProtect MDM
> global-protect-portal Show gloabl protect poral user session info
--more--
> global-protect-satellite Show GlobalProtect satellite run-time objects
> gtp Show GTP information
> high-availability Show high-availability information
> hsm Show HSM information
> interface Show interface information
> jobs Show management server jobs
> lacp Show LACP state
> license-token-files Show license token files for manual license deactivation
> lldp Show LLDP state
> location Show geographic location
> log Show logs related information
> log-collector Show log-collector information
> logging-status Show logging status and info
> mac Show MAC address information
> management-clients Show internal management server clients
> max-num-images Show maximum number of software or content images
> neighbor Show IPv6 neighbor information
> netstat Print network connections and statistics
> ntp Show NTP synchronization state
> object Show IP address object
> obsolete-disabled-ssl-exclusions Show disabled predefined ssl-decrypt exclusions not present in the installed content
> operational-mode Show device operational mode setting
> oss-license show license for open source packages
--more--
> panorama-certificates Show panorama certificate list
> panorama-status Show panorama connection status
> parent-info show parent info
> pbf Show policy-based-forwarding run-time information
> plugins Request information of plugins
> pppoe Show pppoe statistics
> predefined Show predefined config
> qos Show QoS run-time information
> query Show query jobs
> report Show report jobs
> resource Show resource limits information
> routing Show routing run-time objects
> rule-hit-count Show policy rule hit-count information
> running Show running operational parameters
> sctp Show SCTP information
> session Show session information
> sp-metadata sp-metadata
> ssh-fingerprints Show management ssh public key fingerprints
> ssl-conn-on-cert Show setting for ssl fail connection on cert
> sslmgr-store Show sslmgr dynamic configuration
> statistics Show device statistics
> syslogng-ssl-conn-validation Show syslog-ng ssl connection validation settings
> system Show system state and information
--more--
> threat Show Threat id descriptions
> url-cloud Show URL cloud info
> user Show user identification information
> virtual-wire Show virtual-wire information
> vlan Show vlan information
> vm-monitor Show VM monitoring information
> vpn Show IKE/IPSec VPN run-time objects
> wildfire Show wildfire information
> zone-protection Show zone protection runtime statistics

 

Hi @jls3j999 ,

 

"show rulebase security" is command in configuration mode, while you are still in user mode.

If you look again the instructions from @reaper you will see that before executing the "show" command you need to enter configuration mode by typing "configure"

@jls3j999 please follow all the steps, else it won't work 😉

 

Change the cli output mode to set commands

Go into configure mode

Run the show command

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

thanks for your reply

this is what I get

superuser@point-1(active-primary)> configure
Entering configuration mode
[edit]
superuser@point-1(active-primary)# show
deviceconfig deviceconfig
mgt-config mgt-config
network network configuration
predefined predefined
shared shared
template template
vsys vsys
| Pipe through a command
<Enter> Finish input

Since I'm a bit scared, the command you suggested does that make any changes? I suppose not

I mean "show rulebase security | match drop" sorry for being a dummy

can anyone help me?

I mean are there any side-effects while entering the configuration mode?

My purpose is to list all deny rules only (no changes should be made)

thanks

After doing what you said

this is the output:

admin_user@FW-1(active-primary)> set cli config-output-format set
admin_user@FW-1(active-primary)> configure
Entering configuration mode
[edit]
admin_user@FW-1(active-primary)# show
deviceconfig deviceconfig
mgt-config mgt-config
network network configuration
predefined predefined
shared shared
template template
vsys vsys
| Pipe through a command
<Enter> Finish input

admin_user@FW-1(active-primary)# show rulebase security |match drop

Invalid syntax.
[edit]
admin_user@FW-1(active-primary)# 

 

 

can anyone help me?

There appears to be a space missing between the pipe and 'match' ( |match should be | match)

 

The show command in configure mode does not make any changes at all so is safe to use

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

It also looks like you have multiple vsys on that system. If you want to use the entire show command as written, you have to specify the vsys.

show vsys vsysX rulebase security | match drop

 

Or you could just do show | match drop. This will expand the output but might give results that aren't relevant to what you're looking for.

@rmfalconer thanks this command works fine:

show vsys vsys1 rulebase security | match deny

example output:

set vsys vsys1 rulebase security rules FTP-INBOUND-DENY action deny

....

But I expected to get network details as well such as:

192.168.0.10/24  or whatever related to every rule whose action is equal to deny

Using the match command will only output the line where that word specifically appears. If you want detail on each policy, you'll need to match on the policy name.

show vsys vsys1 rulebase security | match FTP-INBOUND-DENY

Is there a specific reason you want to use CLI? There's a filter and export function in the GUI that might work for you. You can filter on the action and then export the table to csv or pdf.

Your suggestion sounds good but my purpose is to get details about the subnets involved

So as well as the list of all DENY rules whose action is actually "deny" I'd like to get further details on the network segment

For instance, with reference to the rule called FTP-INBOUND-DENY, it would be great if I could see something like:

 FTP-INBOUND-DENY 192.168.1.0/24

Through cli it would be better I believe

 

I think using the GUI would be easier in this case. Filer the security policies with (action eq 'deny') or (action eq 'drop') [or whatever action you want to filter on] and export to CSV. 

It shows rule name, src/dst addresses, zones, plus other info. At that point, you can just hide any columns you don't want and you'll have what you're looking for. 


@rmfalconer wrote:

I think using the GUI would be easier in this case. Filer the security policies with (action eq 'deny') or (action eq 'drop') [or whatever action you want to filter on] and export to CSV. 

It shows rule name, src/dst addresses, zones, plus other info. At that point, you can just hide any columns you don't want and you'll have what you're looking for. 


In this case the best filter is probably (action neq 'allow') 🙂

 

 

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization
  • 5657 Views
  • 14 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!