Delete IP Addresses from many policies

[vkvinodin]

Hi Team,

We got one decom request, which contains IP removal, from all address groups and in rules. We have hundreds of rules one of this ip included. as of now we are doing manually, searching policy and removing that IP . Could you please any one help to remove one IP from bulk rules which are mapped to rules.

[TomYoung]

Hi @vkvinodin ,

The easiest way that I know is via CLI.  Run the following commands with the IP that you are looking for.

you@yourfw> set cli config-output-format set
you@yourfw> configure
you@yourfw# show | match ip.ad.dr.ess

You will get a list of all of the commands in which your IP address is used.  Paste these into your text editor.  Change (1) all the ^set to delete and (2) any list inside a bracket to the single IP address, e.g. [ object1 ipaddress1 ... ] to [ ip.ad.dr.ess ].  Paste into the CLI configuration.  (^ = regex beginning of line in case the pattern exists elsewhere.)  (The regex \[.*ip.ad.dr.ess.*\] will match all the existing groups in which the IP exists for a fast search and replace for #2.)

These commands will delete the IP address from everywhere it is used in the configuration.

Unless you enable scripting mode, you can only paste 40 or so commands at a time.  I definitely would test the different types of commands before using them all.  If something gets messed up, the command "revert config" will erase the candidate configuration.

IF the IP address is also an address object, follow the same process with the object name instead of the IP address.

Thanks,

Tom