Removal of Targets from Policy

[GrantCampbell4]

I have a number of firewalls managed in Panorama that are to be decommissioned.

Some of these firewalls are in Device Groups with several thousand policy entries.  Annoyingly they have been assigned the firewalls in the target column.

Does anyone have a documented method as to how to remove targets from a Device Group in Panorama quickly and/or efficiently?

Regards

[chris.short]

We've had a scenario where we had to change hundreds of rules from targeting specific firewalls to target 'any'.

In Panorama CLI you can use:
#show | match "target devices <serial>

This will get you an output of 1000s of policies with that firewall as a target.

#set device-group <deviceGroup> post-rulebase security rules <ruleName> target devices <serial> vsys vsys<X>

Using that output you can edit in notepad to be for example: (really just need to change set to delete and remove the trailing vsys vsysX)

#delete device-group <deviceGroup> post-rulebase security rules <ruleName> target devices <serial>

If you get rid of all firewall targets on a rule, the rule target reverts to 'any' which sounds like what you're after.

Bang the thousands of lines into CLI, if you haven't already, you may need to use the 'set cli config-output-format set' command 

Hope this helps

[TomYoung]

Hi @GrantCampbell4 ,

Simplifying what @chris.short said:

user@panorama> set cli config-output-format set
user@panorama> configure
user@panorama# show | match "target devices <serial>"

Copy output to notepad.  Replace 'set' with 'delete' and paste into the CLI.  The docs say if you want to paste more than 20 lines at a time, use the 'set cli scripting-mode on' command in operational mode.  Then turn it off with 'set cli scripting-mode off'.

You can omit the S/N in the show command to see all of the targets in the configuration.

Thanks,

Tom