topic Re: How to View Deleted Rules/Objects on the Firewall? in General Topics

How to View Deleted Rules/Objects on the Firewall?

tawsif — Wed, 05 Jan 2022 22:07:46 GMT

Is there a way to check for the deleted rules/objects on the firewall once it is published and has been installed? I've tried to open the revision session, but still unable to check for the deleted rules/objects on the firewall. We're running on R80.40. Thanks.

Re: How to View Deleted Rules/Objects on the Firewall?

Chris_Atkinson — Thu, 06 Jan 2022 02:51:37 GMT

The "Audit Logs" pane should detail the changes, is no information available there in your environment?

Also depending on the version you will have a "Changes" option under "Actions" to compare the policy revisions.

Re: How to View Deleted Rules/Objects on the Firewall?

Alex- — Thu, 06 Jan 2022 12:29:23 GMT

Here's a crude one-liner to run in Expert mode that will create a CSV with all deleted objects since last publish. For hosts and networks, it will give IP and subnet mask. For groups, the name. All the rest, name and UID. Output will be saved in deleted_items.csv

Example output from a lab environment where I deleted a bunch of things.

cat deleted_items.csv "\"Host_5\",\"host\",\"10.10.10.5\"" "\"Host_3\",\"host\",\"10.10.10.3\"" "\"Host_1\",\"host\",\"10.10.10.1\"" "\"Host_2\",\"host\",\"10.10.10.2\"" "\"Host_4\",\"host\",\"10.10.10.4\"" "\"myNet_1\",\"network\",\"10.10.100.0\",\"255.255.255.0\"" "\"myNet_2\",\"network\",\"10.10.200.0\",\"255.255.255.0\"" "\"myGroup\",\"group\"" ",\"access-rule\",\"b2766e39-480c-4090-ad2f-4252ca6b6f12\""

Re: How to View Deleted Rules/Objects on the Firewall?

HeikoAnkenbrand — Thu, 06 Jan 2022 18:41:38 GMT

nice oneliner

Re: How to View Deleted Rules/Objects on the Firewall?

Danny — Thu, 06 Jan 2022 21:37:38 GMT

sk166435 - How to view changes performed between revisions

Re: How to View Deleted Rules/Objects on the Firewall?

Swordfish — Fri, 07 Jan 2022 07:21:09 GMT

You should see the changes in Smart Dashboard > Security Policies > Access Tools > Installation History. You can click in the history on "View installed changes" and can expand the audit logs, which gives you a more detailed view.