- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
08-06-2025 07:24 AM
Hi Team
I am trying to pull the details of disabled rule in set format. I am using pan-sdk .
I can pull the complete list but not able to retrieve only rule which are disabled.
And is to possible to pull rule in "set" format or need to use XML API ?
Any pointer will help here.
Thanks,
Deepak
08-19-2025 03:13 PM
Hi @D.Verma502651 ,
There is one "quick and dirty" way to achieve what you want, without any scripting or API.
Little fun facts first:
- PanOS is utilizing the "less" pager when showing any file (being log or config file)
- less has a build-in feature that allow you to show only the lines of the file which match a given pattern - https://man7.org/linux/man-pages/man1/less.1.html
&pattern Display only lines which match the pattern; lines which do not match the pattern are not displayed. If pattern is empty (if you type & immediately followed by ENTER), any filtering is turned off, and all lines are displayed. While filtering is in effect, an ampersand is displayed at the beginning of the prompt, as a reminder that some lines in the file may be hidden. Multiple & commands may be entered, in which case only lines which match all of the patterns will be displayed.
In a nutshell you have "grep" capabilities for the config file right in the firewall.
Armed with this information you could:
1. Login to Firewall/Panorama CLI
2. Set the config output to set
user@My-PAN-FW> set cli config-output-format set
3. Enter configure mode and climb the configuration hierarchy
# For Panorama
[edit]
user@My-Panorama# edit device-group My-PAN-FW pre-rulebase security
[edit device-group My-PAN-FW pre-rulebase security]
user@MY-Panorama# show
# For Firewall
[edit]
user@My-PAN-FW# edit rulebase security
[edit rulebase security]
user@My-PAN-FW# show
4. As your firewall policy is longer than your terminal the output will be presented by the "less". While inside "less" you enter the "&" followed by the pattern you search. In your case you look for all rules that are disabled
&disabled\ yes
Above will return all lines where the "disabled yes" is found. Since the output is in set format the name of the firewall rule will be in the same line.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!