Using scripting mode to modify existing security rules

[FrancoisNoel]

Hi,

   I was wondering if anybody has experience working with the scripting mode in the way I need.

Using the following commands, it is possible to add a single application or service to a rule:

set device-group INTERNAL post-rulebase security rules SEC-APP application [ ssl ]

set device-group INTERNAL post-rulebase security rules WEB-APP service [ http ]

I would like to know if the opposite is feasible: is there a command to remove a single service or a single application from a rule without having to reconfigure the whole rule?

If this is not possible then the only way is to delete the rule and reconfigure it altogether?

Thanks

[BPry]

@FrancoisNoel,

This should work perfectly fine, at least on 9.1 and 10.0. You can go through and add a single application or service and remove them as needed without removing the entire entry. 

[FrancoisNoel]

Thanks for your reply BPry but what is the set command line to remove a single app or service?

[BPry · Accepted solution]

@FrancoisNoel,

You wouldn't use set to remove an application or service member, you would use delete. 

[FrancoisNoel]

Thank you very much BPry

Just an FYI.

I first tried this: delete device-group INTERNAL post-rulebase security rules SEC-APP application [ ssl ] 

But that didn't work because of the [ ]

I removed the [ ] and all was fine.

Thanks again! Much appreciated!