About GabrielMontiel

Oh now i get you, best way to do this imo, is filter by the policy name on monitor, extract CSV columns ( you can extend the amount of rows you can export in device/panorama, on the setup page https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaPCAS ) And then start filtering with excel, and create the new policies above the current general one, you can repeat this process until you have no new hits on the old policy. ... View more

Im not quite sure what you mean with "server to server" if by that you mean a single IP address, or a CIDR address range, you can see new applications or the applications used within a single security policy rule, with that you can separate each server flow with security policies and with the policy optimizer in security policy GUI page theres a column named "apps seen" you can click on that number and see which applications have done a match with that security policy ... View more

I understood your use case, yes policy optimizer is mostly to use applications in policies. If you want to "close" the policy to some src and dst addresses it would be easier for you to create a custom report filtering with the policy name, or simply in the ACC filter to policy name, also you could extract palo alto logs in csv format and do some excel dynamic table magic its a button on top right in the monitor traffic logs ... View more

Dont need to do that! Thankfully palo alto has already a tool INTEGRATED into the firewall, you can see it at the left bottom corner its called policy optimizer, which does exactly that what you are asking for, but without running trough so many hops, https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/app-id/security-policy-rule-optimization/migrate-port-based-to-app-id-based-security-policy-rules   Also i would suggest you to read and watch some tutorials on the expedition tool, which helps your migrations from old FW to NGFW from palo alto networks, https://www.paloaltonetworks.com/products/secure-the-network/next-generation-firewall/migration-tool I hope this information suits you well! ... View more

Yes i just saw that terraformer had support for the panos terraform provider just recently, there's an issue with it though that the policies can not have a whitespace in the name. i guess its easier to pull request than to build it from scratch ... View more