List all deny rules from cli

[jls3j999]

I have to list all deny rules (from cli)

The following command "show running security-policy | match index " list all security rules by name

For example:

"AllowBrach1IN; index: 1" {

....etc

What I want is:

- deny INBOUND traffic rules only but regarding entire subnets (those having CIDR as their destination ...like 192.168.1.0/24..etc)

Is there any way to filter out that type of information?

Thanks,

[jls3j999]

@rmfalconer thanks this command works fine:

show vsys vsys1 rulebase security | match deny

example output:

set vsys vsys1 rulebase security rules FTP-INBOUND-DENY action deny

....

But I expected to get network details as well such as:

192.168.0.10/24  or whatever related to every rule whose action is equal to deny

[rmfalconer]

Using the match command will only output the line where that word specifically appears. If you want detail on each policy, you'll need to match on the policy name.

show vsys vsys1 rulebase security | match FTP-INBOUND-DENY

Is there a specific reason you want to use CLI? There's a filter and export function in the GUI that might work for you. You can filter on the action and then export the table to csv or pdf.

[jls3j999]

Your suggestion sounds good but my purpose is to get details about the subnets involved

So as well as the list of all DENY rules whose action is actually "deny" I'd like to get further details on the network segment

For instance, with reference to the rule called FTP-INBOUND-DENY, it would be great if I could see something like:

 FTP-INBOUND-DENY 192.168.1.0/24

Through cli it would be better I believe

[rmfalconer]

I think using the GUI would be easier in this case. Filer the security policies with (action eq 'deny') or (action eq 'drop') [or whatever action you want to filter on] and export to CSV. 

It shows rule name, src/dst addresses, zones, plus other info. At that point, you can just hide any columns you don't want and you'll have what you're looking for. 

[reaper]

---

@rmfalconer wrote:

I think using the GUI would be easier in this case. Filer the security policies with (action eq 'deny') or (action eq 'drop') [or whatever action you want to filter on] and export to CSV. 

It shows rule name, src/dst addresses, zones, plus other info. At that point, you can just hide any columns you don't want and you'll have what you're looking for. 

---

In this case the best filter is probably (action neq 'allow') 🙂