Hi @D.Verma502651 ,
There is one "quick and dirty" way to achieve what you want, without any scripting or API.
Little fun facts first: - PanOS is utilizing the "less" pager when showing any file (being log or config file)
- less has a build-in feature that allow you to show only the lines of the file which match a given pattern - https://man7.org/linux/man-pages/man1/less.1.html
&pattern
Display only lines which match the pattern; lines which do
not match the pattern are not displayed. If pattern is
empty (if you type & immediately followed by ENTER), any
filtering is turned off, and all lines are displayed.
While filtering is in effect, an ampersand is displayed at
the beginning of the prompt, as a reminder that some lines
in the file may be hidden. Multiple & commands may be
entered, in which case only lines which match all of the
patterns will be displayed.
In a nutshell you have "grep" capabilities for the config file right in the firewall.
Armed with this information you could:
1. Login to Firewall/Panorama CLI
2. Set the config output to set
user@My-PAN-FW> set cli config-output-format set
3. Enter configure mode and climb the configuration hierarchy
# For Panorama
[edit]
user@My-Panorama# edit device-group My-PAN-FW pre-rulebase security
[edit device-group My-PAN-FW pre-rulebase security]
user@MY-Panorama# show
# For Firewall
[edit]
user@My-PAN-FW# edit rulebase security
[edit rulebase security]
user@My-PAN-FW# show
4. As your firewall policy is longer than your terminal the output will be presented by the "less". While inside "less" you enter the "&" followed by the pattern you search. In your case you look for all rules that are disabled
&disabled\ yes
Above will return all lines where the "disabled yes" is found. Since the output is in set format the name of the firewall rule will be in the same line.
... View more
