PAN-OS create or edit policy

This playbook will automate the process of creating or editing a policy. The first task in the playbook checks if there is a security policy that matches the playbook inputs. If there is no security policy that matches, a new policy will be created. If there is a security policy that matches, the user will be able to modify the existing policy or create a new hardened policy.

Change Management · 19 tasks · 17 inputs · 0 outputs

Inputs

  • Destination —
  • Source —
  • Protocol — The IP protocol number
  • Action — Action for the rule (allow, deny, drop)
  • Application — A comma-separated list of application object names for the rule to create.
  • Destination_zone — A comma-separated list of destination zones.
  • Log_forwarding — Log forwarding profile.
  • Profile_setting — A profile setting group.
  • Rulename — Name of the rule to create.
  • Service — A comma-separated list of service object names for the rule.
  • Source_zone — A comma-separated list of source zones.
  • Email — The email of the network/security team.
  • Rule_position — Pre rule or Post rule (Panorama instances). Possible options: - post-rulebase - pre-rulebase
  • Destination_port —
  • Target — Target number of the firewall. Use only for a Panorama instance.
  • Vsys — Target vsys of the firewall. Use only for a Panorama instance.
  • Limit — Maximum number of API requests that the PanoramaSecurityPolicyMatchWrapper script will send. The default is 500.

Commands used

pan-os-create-rule setIncident

Flowchart

yes Don't modify Modify Create Edit Manually review Start Start Search for matching security policy? - PanoramaSecurityPolicyMatchWrapper Search for matching secur... PanoramaSecurityPolicyMatchWr... Is there matching security policy? Is there matching securit... Edit existing rule Edit existing rule Create new rule - pan-os-create-rule Create new rule pan-os-create-rule Done Done Ask if harden/modify the existing policy? Ask if harden/modify the ... PAN-OS Commit Configuration - PAN-OS Commit Configuration PAN-OS Commit Configuration PAN-OS Commit Configuration Create new rule or edit existing? Create new rule or edit e... Create a new harden rule - pan-os-create-rule Create a new harden rule pan-os-create-rule PAN-OS Commit Configuration - PAN-OS Commit Configuration PAN-OS Commit Configuration PAN-OS Commit Configuration Manually review the relevant rule Manually review the relev... Set security policy match to layout - SetGridField Set security policy match... SetGridField PAN-OS Commit Configuration - PAN-OS Commit Configuration PAN-OS Commit Configuration PAN-OS Commit Configuration Update incident state - setIncident Update incident state setIncident Update incident state - setIncident Update incident state setIncident Update incident state - setIncident Update incident state setIncident PAN-OS edit policy - PAN-OS edit policy PAN-OS edit policy PAN-OS edit policy Which action was selected? Which action was selected?