Script for pulling disabled rule in set format

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Script for pulling disabled rule in set format

L0 Member

Hi Team 
I am trying to pull the details of disabled rule in set format. I am using pan-sdk .
I can pull the complete list but not able to retrieve only rule which are disabled.
And is to possible to pull rule in "set" format or need to use XML API ?

Any pointer will help here.

Thanks,

Deepak

1 REPLY 1

Hi @D.Verma502651 , 

There is one "quick and dirty" way to achieve what you want, without any scripting or API.

Little fun facts first:
- PanOS is utilizing the "less" pager when showing any file (being log or config file)

- less has a build-in feature that allow you to show only the lines of the file which match a given pattern - https://man7.org/linux/man-pages/man1/less.1.html 


  &pattern
              Display only lines which match the pattern; lines which do
              not match the pattern are not displayed.  If pattern is
              empty (if you type & immediately followed by ENTER), any
              filtering is turned off, and all lines are displayed.
              While filtering is in effect, an ampersand is displayed at
              the beginning of the prompt, as a reminder that some lines
              in the file may be hidden.  Multiple & commands may be
              entered, in which case only lines which match all of the
              patterns will be displayed.


In a nutshell you have "grep" capabilities for the config file right in the firewall.

 

Armed with this information you could:

1. Login to Firewall/Panorama CLI

2. Set the config output to set

user@My-PAN-FW> set cli config-output-format set

3. Enter configure mode and climb the configuration hierarchy

# For Panorama
[edit]
user@My-Panorama# edit device-group My-PAN-FW pre-rulebase security
[edit device-group My-PAN-FW pre-rulebase security]
user@MY-Panorama# show


# For Firewall
[edit]
user@My-PAN-FW# edit rulebase security
[edit rulebase security]
user@My-PAN-FW# show

4. As your firewall policy is longer than your terminal the output will be presented by the "less". While inside "less" you enter the "&" followed by the pattern you search. In your case you look for all rules that are disabled 

&disabled\ yes

Above will return all lines where the "disabled yes" is found. Since the output is in set format the name of the firewall rule will be in the same line.

 

 

  • 247 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!