List all deny rules from cli

[jls3j999]

I have to list all deny rules (from cli)

The following command "show running security-policy | match index " list all security rules by name

For example:

"AllowBrach1IN; index: 1" {

....etc

What I want is:

- deny INBOUND traffic rules only but regarding entire subnets (those having CIDR as their destination ...like 192.168.1.0/24..etc)

Is there any way to filter out that type of information?

Thanks,

[jls3j999]

thanks for your reply

this is what I get

superuser@point-1(active-primary)> configure
Entering configuration mode
[edit]
superuser@point-1(active-primary)# show
deviceconfig deviceconfig
mgt-config mgt-config
network network configuration
predefined predefined
shared shared
template template
vsys vsys
| Pipe through a command
<Enter> Finish input

Since I'm a bit scared, the command you suggested does that make any changes? I suppose not

I mean "show rulebase security | match drop" sorry for being a dummy

[jls3j999]

can anyone help me?

I mean are there any side-effects while entering the configuration mode?

My purpose is to list all deny rules only (no changes should be made)

thanks

[jls3j999]

After doing what you said

this is the output:

admin_user@FW-1(active-primary)> set cli config-output-format set
admin_user@FW-1(active-primary)> configure
Entering configuration mode
[edit]
admin_user@FW-1(active-primary)# show
deviceconfig deviceconfig
mgt-config mgt-config
network network configuration
predefined predefined
shared shared
template template
vsys vsys
| Pipe through a command
<Enter> Finish input

admin_user@FW-1(active-primary)# show rulebase security |match drop

Invalid syntax.
[edit]
admin_user@FW-1(active-primary)# 

can anyone help me?

[jls3j999]

can anyone help me?

[reaper]

There appears to be a space missing between the pipe and 'match' ( |match should be | match)

The show command in configure mode does not make any changes at all so is safe to use

[rmfalconer]

It also looks like you have multiple vsys on that system. If you want to use the entire show command as written, you have to specify the vsys.

show vsys vsysX rulebase security | match drop

Or you could just do show | match drop. This will expand the output but might give results that aren't relevant to what you're looking for.