How to Import and Export local Address and Address Objects between Firewalls

How to Import and Export local Address and Address Objects between Firewalls

Created On 09/25/18 17:39 PM - Last Modified 12/20/23 21:17 PM


This document describes how to import and export address and address objects from one firewall to another without having to redefine them manually. This document can be used in scenarios where multiple Palo Alto Networks firewalls at different sites want to leverage an existing address/ address-group configuration.


  • Palo Alto Firewall
  • Importing locally stored Address Objects


  1. Verify from the existing firewall, that Address and Address-objects exists using GUI: Objects > Address and Address Groups
  1. From the CLI, set the configuration output format to 'set' and extract address and address/group information:  (NoteWorks for locally stored address only, not Panorama pushed Addresses)
    > set cli config-output-format set
    > configure
    Entering configuration mode
    # show address
    set address google fqdn
    set address google description "FQDN address object for"set address mgmt-L3 ip-netmask
    set address mgmt-L3 description "IP Netmask address object for mgmt-L3"
    set address trust-L3 ip-netmask
    set address untrust-L3 ip-netmask
    set address dmz-L3 ip-netmask
    # show address-group
    set address-group Inside static [ dmz-L3 mgmt-L3 trust-L3 ]
    set address-group Outside static [ google untrust-L3 ]
  2. Copy all the 'set' commands from the above output to a Notepad file, and edit as desired for other firewalls. For address-groups, make sure that the entire set command is copied/pasted including the '[ ]' part
  3. Login into the CLI of other firewalls, move the CLI config-output-format to 'set' and paste the commands into the configuration mode and commit the configuration.
    > set cli config-output-format set
    > configure
    # <paste all the set commands here>
    # commit



  • Print
  • Copy Link

Choose Language