List all deny rules from cli
cancel
Showing results for 
Search instead for 
Did you mean: 

List all deny rules from cli

L1 Bithead

I have to list all deny rules (from cli)

The following command "show running security-policy | match index " list all security rules by name

For example:

"AllowBrach1IN; index: 1" {

....etc

What I want is:

- deny INBOUND traffic rules only but regarding entire subnets (those having CIDR as their destination ...like 192.168.1.0/24..etc)

Is there any way to filter out that type of information?

Thanks,

 

14 REPLIES 14

@rmfalconer thanks this command works fine:

show vsys vsys1 rulebase security | match deny

example output:

set vsys vsys1 rulebase security rules FTP-INBOUND-DENY action deny

....

But I expected to get network details as well such as:

192.168.0.10/24  or whatever related to every rule whose action is equal to deny

Using the match command will only output the line where that word specifically appears. If you want detail on each policy, you'll need to match on the policy name.

show vsys vsys1 rulebase security | match FTP-INBOUND-DENY

Is there a specific reason you want to use CLI? There's a filter and export function in the GUI that might work for you. You can filter on the action and then export the table to csv or pdf.

Your suggestion sounds good but my purpose is to get details about the subnets involved

So as well as the list of all DENY rules whose action is actually "deny" I'd like to get further details on the network segment

For instance, with reference to the rule called FTP-INBOUND-DENY, it would be great if I could see something like:

 FTP-INBOUND-DENY 192.168.1.0/24

Through cli it would be better I believe

 

I think using the GUI would be easier in this case. Filer the security policies with (action eq 'deny') or (action eq 'drop') [or whatever action you want to filter on] and export to CSV. 

It shows rule name, src/dst addresses, zones, plus other info. At that point, you can just hide any columns you don't want and you'll have what you're looking for. 


@rmfalconer wrote:

I think using the GUI would be easier in this case. Filer the security policies with (action eq 'deny') or (action eq 'drop') [or whatever action you want to filter on] and export to CSV. 

It shows rule name, src/dst addresses, zones, plus other info. At that point, you can just hide any columns you don't want and you'll have what you're looking for. 


In this case the best filter is probably (action neq 'allow')

 

 

Tom Piens
Like my answer? check out my book! https://bit.ly/MasteringPAN
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!