List all deny rules from cli

Showing results for 
Search instead for 
Did you mean: 

List all deny rules from cli

L1 Bithead

I have to list all deny rules (from cli)

The following command "show running security-policy | match index " list all security rules by name

For example:

"AllowBrach1IN; index: 1" {


What I want is:

- deny INBOUND traffic rules only but regarding entire subnets (those having CIDR as their destination

Is there any way to filter out that type of information?




Cyber Elite
Cyber Elite

Give this a shot:


reaper@PANgurus> set cli config-output-format set
reaper@PANgurus> configure
Entering configuration mode
[edit]                                                                             reaper@PANgurus# show rulebase security | match drop
Tom Piens

thanks a lot but it seems to me that show rulebase command is missing

here's the putput I get if I type show

> admins Show active administrators
> api-key-expiration-ts Shows the time before which any API keys would be invalid
> arp Show ARP information
> auth auth state variables
> authentication Show authentication related information
> chassis Chassis state and information
> chassis-ready Show whether dataplane has a running policy
> cli Show CLI properties
> clock Show system date and time
> commit-locks Show list of commit locks
> config Show configuration
> config-locks Show list of config locks
> counter Show system counter information
> device-certificate Show device certificate
> dhcp Show DHCP data
> dns-proxy Show DNS Proxy information
> dos-block-table Show hardware ACL or Block-ip table
> dos-protection Show DoS protection related information
> global-protect Show settings for GlobalProtect
> global-protect-gateway Show GlobalProtect gateway run-time objects
> global-protect-mdm Show settings for GlobalProtect MDM
> global-protect-portal Show gloabl protect poral user session info
> global-protect-satellite Show GlobalProtect satellite run-time objects
> gtp Show GTP information
> high-availability Show high-availability information
> hsm Show HSM information
> interface Show interface information
> jobs Show management server jobs
> lacp Show LACP state
> license-token-files Show license token files for manual license deactivation
> lldp Show LLDP state
> location Show geographic location
> log Show logs related information
> log-collector Show log-collector information
> logging-status Show logging status and info
> mac Show MAC address information
> management-clients Show internal management server clients
> max-num-images Show maximum number of software or content images
> neighbor Show IPv6 neighbor information
> netstat Print network connections and statistics
> ntp Show NTP synchronization state
> object Show IP address object
> obsolete-disabled-ssl-exclusions Show disabled predefined ssl-decrypt exclusions not present in the installed content
> operational-mode Show device operational mode setting
> oss-license show license for open source packages
> panorama-certificates Show panorama certificate list
> panorama-status Show panorama connection status
> parent-info show parent info
> pbf Show policy-based-forwarding run-time information
> plugins Request information of plugins
> pppoe Show pppoe statistics
> predefined Show predefined config
> qos Show QoS run-time information
> query Show query jobs
> report Show report jobs
> resource Show resource limits information
> routing Show routing run-time objects
> rule-hit-count Show policy rule hit-count information
> running Show running operational parameters
> sctp Show SCTP information
> session Show session information
> sp-metadata sp-metadata
> ssh-fingerprints Show management ssh public key fingerprints
> ssl-conn-on-cert Show setting for ssl fail connection on cert
> sslmgr-store Show sslmgr dynamic configuration
> statistics Show device statistics
> syslogng-ssl-conn-validation Show syslog-ng ssl connection validation settings
> system Show system state and information
> threat Show Threat id descriptions
> url-cloud Show URL cloud info
> user Show user identification information
> virtual-wire Show virtual-wire information
> vlan Show vlan information
> vm-monitor Show VM monitoring information
> vpn Show IKE/IPSec VPN run-time objects
> wildfire Show wildfire information
> zone-protection Show zone protection runtime statistics


Hi @jls3j999 ,


"show rulebase security" is command in configuration mode, while you are still in user mode.

If you look again the instructions from @reaper you will see that before executing the "show" command you need to enter configuration mode by typing "configure"

@jls3j999 please follow all the steps, else it won't work 😉


Change the cli output mode to set commands

Go into configure mode

Run the show command

Tom Piens

thanks for your reply

this is what I get

superuser@point-1(active-primary)> configure
Entering configuration mode
superuser@point-1(active-primary)# show
deviceconfig deviceconfig
mgt-config mgt-config
network network configuration
predefined predefined
shared shared
template template
vsys vsys
| Pipe through a command
<Enter> Finish input

Since I'm a bit scared, the command you suggested does that make any changes? I suppose not

I mean "show rulebase security | match drop" sorry for being a dummy

can anyone help me?

I mean are there any side-effects while entering the configuration mode?

My purpose is to list all deny rules only (no changes should be made)


After doing what you said

this is the output:

admin_user@FW-1(active-primary)> set cli config-output-format set
admin_user@FW-1(active-primary)> configure
Entering configuration mode
admin_user@FW-1(active-primary)# show
deviceconfig deviceconfig
mgt-config mgt-config
network network configuration
predefined predefined
shared shared
template template
vsys vsys
| Pipe through a command
<Enter> Finish input

admin_user@FW-1(active-primary)# show rulebase security |match drop

Invalid syntax.



can anyone help me?

There appears to be a space missing between the pipe and 'match' ( |match should be | match)


The show command in configure mode does not make any changes at all so is safe to use

Tom Piens

It also looks like you have multiple vsys on that system. If you want to use the entire show command as written, you have to specify the vsys.

show vsys vsysX rulebase security | match drop


Or you could just do show | match drop. This will expand the output but might give results that aren't relevant to what you're looking for.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!