Unused Services

[jdprovine]

Is there a way to tell if a service is being used? I am trying to verify that the services the migration tool lists as unused can be deleted. It might be enough to go by what the migration tool says but I usually like to verify it a couple different ways.

[DonohoeRobert]

Hi Mate, 

Would trust the migration tool. Its checking the xml for occurrances of the named object. If its not in the config it highlights it. 

There's another handy bit of kit called the configurator. If you can get you head around the coding its very useful.

There's one cmd to delete all unused objects. If ye can delete them ye can probably parse them as well. All depends on how many ye have. 10 / 20 can check manually in the xml file yer self. 100's or 1000's maybe try sus out the configurator.. 

https://live.paloaltonetworks.com/t5/General-Topics/Pan-Configurator-service-edit-php/m-p/169839#M53...

https://github.com/cpainchaud/pan-configurator

is open source, as far as I know a pan engineer developed it and maintains it.. 

some example of the code below 

Delete unused objects from a config :

    foreach($pan->addressStore->addressObjects() as $object )
      if( $object->countReferences() == 0 )
        $pan->addressStore->remove($object);

Want to know where an object is used ?

    $object = $pan->addressStore->find('H-WebServer4');
    foreach( $object->getReferences() as $ref )
       print $ref->toString()."\n";

cheers

rob 

[reaper]

and if you want to double-double check you can do a "Global Find" (top right search box or drop-down option on the service) that will search through your entire config and highlight all the places the object appears:

Global Find

[swaschkut]

regarding the solution mentioned above by using the pan-configurator:

I recommend the util script which are coming with the pan-configurator:

php service-edit.php in=api://[DEVICE-MGTM-IP] actions=delete 'filter=(object is.unused.recursive)'

With this your changes are done against the configuration available on your Palo Alto Networks firewall.

It is also possible to manipulate an offline PAN-OS config file:

php service-edit.php in=[INPUT-FILE].xml out=[OUTPUT-FILE].xml actions=delete 'filter=(object is.unused.recursive)'