topic Re: Rule merge all results in Expedition Discussions

Rule merge all results

aporue — Wed, 06 Mar 2019 17:30:45 GMT

I am running Expedition 1.0.106 and have a question about merging rules. Once the analysis is done I am presented with cases that I look at individually. From there I can merge by highlighting the rules or by clicking on the 'merge by selection or all results'. Either one of those ways works to merge a case. The question I have is the part that says '...or all results'. I have over 4000 cases and would like to choose to merge all results but it does not work. When I have no cases selected and click the button it says it has merged 2 rules (not sure what is up with that) but it does not merge all results. As an alternative, I check the box next to 'Duplicates' which should select all cases but it says you can only select 10 cases at a time.

Thanks for any help.

Re: Rule merge all results

dgildelaig — Fri, 08 Mar 2019 12:10:37 GMT

Please check with the most current version of Expedition, 1.1.9, to see if this aspect has been fixed in iterations between your version and the most recent one.

If not, let's try to check it again with some examples?

Re: Rule merge all results

aporue — Fri, 08 Mar 2019 17:10:48 GMT

I upgraded the tool to 1.1.19 but it did not help. Just to make sure here are the steps I am following.

1. From Policies choose 'Filters'

2. Choose Merge, Analyze, Policies, Security Policies

3. In the section titled 'Show rules by identical,' I choose action, from, to, source, destination

4. I then click the blue 'analyze and filter' button

5. After the analysis is done I would click the green button that says 'Merge by selection or all results' (since I have not selected any cases to merge I was hoping it would merge 'all results'). It does not merge all results and even though no cases are chosen it still says it has combined a couple of security rules.

6. If instead choose 10 separate cases to merge it will still only merge the last case that was chosen.

Hopefully, this helps explain what I am trying to do and what is not working.

Thanks.

Re: Rule merge all results

sjanita — Sun, 10 Mar 2019 09:49:36 GMT

to clarify the behavior of the "Merge by selection or all results', the result of clicking this button will not merge the rules in all cases listed. Instead the behavior is intended to be used as an option to choose to merge all of the matched results on a case by case basis.

The alternative to using the 'Merge by selection of all results' is to first click on the case, which will display the results - matched security policies that can be merged, is to manually choose the security policies to merge then click on the 'Merge by selection of all results' button.

So the workflow is you must first select the case then choose to merge all of select only those policies that should be merged.

From a safe practice recommendation, the matches of which security policies to be merged should be reviewed prior to choosing to merge them.

Re: Rule merge all results

aporue — Mon, 11 Mar 2019 14:32:59 GMT

I understand what you are saying about ‘safe practice’ and do intend to review all of the cases but still don’t understand the behavior of the button. The button says to “Merge by selection OR all results”. That implies to me that without selecting any cases it will merger all cases(all results). That would be very helpful as it is easier to click through the cases to verify they are correct and then to either select all of them or none and clicking the button then should merge them all. On the other hand, I would be ok if I could just select a bunch of cases at once and merge them. The tool lets you choose multiple cases (or click the box next to ‘Duplicates’ to select all…although it does come back to say that you can only select 10 cases at a time) but it does not work. If I choose 2 or 3 cases as an example and click the merge button it comes back to show that only the last case chosen was merged. I have tried that a bunch of times and it still does nothing more than merge the last case chosen.

Thanks

Re: Rule merge all results

sjanita — Mon, 11 Mar 2019 21:44:17 GMT

I will verify the option to select up to 10 cases.

But wording wise, the wording can be improved upon for clearer intent, but the intent is to force the user to choose the cases from the listing and display the results (of the rules that can be merged upon review) for review prior to merging.

Re: Rule merge all results

YungOng1 — Mon, 11 Mar 2019 22:09:16 GMT

If i can add my 2 cents to what @aporue proposed.

If possible, it would be very helpful if we can select a large number of cases to be merged individually. This would help the repetition of doing each case individually. Especially when there are hundreds of cases.

There is the excel export of the cases which can be used to verify before doing a large number of merges. eg. i can verify that cases 1-10 and 12-15 are cases i want to merge individually.

My experiences on 1.1.8 and 1.1.9 is the same, when more than one case is selected, it only merge the last case.

Re: Rule merge all results

sjanita — Mon, 11 Mar 2019 22:13:44 GMT

i'll look into the option to select 10, if that is not working then I will file a bug.

Re: Rule merge all results

aporue — Thu, 14 Mar 2019 14:50:37 GMT

Any update on this issue? I have a project that has 4000 cases to merge so even doing 10 at a time will take forever so the option to be able to merge all cases at once would be very helpful. Like the other poster stated we can download the spreadsheet of cases and review offline to determine that they are correct. Plus, I have not seen a case yet that was not correct as all I am filtering on is source/destination.

Thanks.

Re: Rule merge all results

aporue — Mon, 18 Mar 2019 13:50:32 GMT

Any updates on this issue?

thanks.

Re: Rule merge all results

dgildelaig — Thu, 21 Mar 2019 08:08:33 GMT

We still have to check this case and correct it if not behaving as it should.

Re: Rule merge all results

RyanBoyd — Thu, 28 Mar 2019 00:11:04 GMT

Also impacted by this limitation. 😐 Awaiting a fix or work around.

Re: Rule merge all results

aporue — Tue, 02 Apr 2019 19:35:18 GMT

Any updates on when/if this issue will be resolved?

Thanks,

Keith

Re: Rule merge all results

aporue — Tue, 09 Apr 2019 13:55:24 GMT

As it has been 3 weeks since your last response I just wanted to check again to see if/when this issue will be fixed?

Re: Rule merge all results

dgildelaig — Tue, 09 Apr 2019 13:58:33 GMT

Rule merge will come tomorrow.

However, it will still be limited to 10 merges at a time.

Additionally, it will check that you do not merge rules with "any" and values in Users, Applications and Services

Re: Rule merge all results

aporue — Tue, 09 Apr 2019 14:09:12 GMT

Thanks for the update, 10 at a time is better than 1 so that will be helpful. I do want to ask about the 2nd part of your response as it relates to 'any'. When migrating from Cisco ASA (and other firewalls also) the application field will always be 'Any' as the ASA is not doing app-id. Does that mean we can still only do 1 rule merge at a time? Hopefully, that is not the case.

Re: Rule merge all results

dgildelaig — Tue, 09 Apr 2019 14:14:02 GMT

No, that is not the case.

What we won't merge are rules where some have "any" (does not have a specfic value) and others have specific values. As the result would not be "any", but the specifics.

For instance,
RULE1 Trust 10.0.0.0/24 -> DMZ 172.16.0.0/25 SSH app-default ALLOW (users)

RULE2 Trust 192.168.10.0/24 -> DMZ 172.16.0.0/25 any app-default ALLOW (admins)

We do not want to merge them into
RULE3 Trust 10.0.0.0/24, 192.168.10.0/24 -> DMZ 172.16.0.0/25 SSH app-default ALLOW

As admins lost access to other allowed apps.
The same would apply to users and to ports.

Re: Rule merge all results

rolinger — Fri, 12 Apr 2019 16:55:25 GMT

I am dealing with something similar, we are importing thousands of rules from multipe FWs and needing to consolidate/merge rules. Each 'filter' we apply is returning hundreds of cases. We need an option that we can select that will simply merge ALL Cases into case specific rules. The project I am on has over 250 FWs, from different vendors, being merged into a handful of 7000s. Every two weeks we are migrating 10,000+ rules....we have a lot of it streamlined until we get to rule consolidation...6 or 7 different consolidation filters are spawning thousands of cases per migration.

[ ] Merge ALL Cases by Case

IE:

Case 1 (9 rules)

Case 2 (24 rules)

Case 3 (19 rules)

...

Case 347 (17 rules)

= would out put 347 individual rules.

Re: Rule merge all results

rolinger — Fri, 12 Apr 2019 17:03:17 GMT

My client is also on an older version of Expedition (1.0.105). Working on getting them to upgrade. However is the intent of Consolidating Rules "Merge Selected" to Merge Cases by Case - but only (currently) 10 at a time?

Case 1 (9 rules)

Case 2 (16 rules)

....

Case 10 (14 rules)

== outputs 10 individual rules??? Cause right now, in our version I think thats broken and we are having to do one case at a time. This is painful.

Re: Rule merge all results

dgildelaig — Fri, 12 Apr 2019 19:08:15 GMT

It is now supporting 10 cases (which it means more than 10 rules).

We will modify the merge behaviour to support multiple merges in the background, as merging security rules implies quite a number of check and calculations.