topic Re: How to identify unused objects? in General Topics

How to identify unused objects?

Gururaj — Thu, 28 Aug 2014 06:14:43 GMT

Hi All,

Is it possible to identify unused objects,.? eg: address, address group, app group etc

We are using PS2050 which is taking too much time for commit ( arroung 30 minutes) so i want to remove unused objects from the device which may helps to improve commit

we have more than 700 objects defined and about 220 policies it is very difficult to identify unused objects manually in this scenario.

Thank you,

Gururaj

Re: How to identify unused objects?

bat — Thu, 28 Aug 2014 07:01:25 GMT

Hi Gururaj

The following document can be helpful:

How to Identify Unused Policies on a Palo Alto Networks Device

Thanks

Re: How to identify unused objects?

HULK — Thu, 28 Aug 2014 09:18:33 GMT

Hello Gururaj,

As csharma mentioned above, we can identify any unused policy on this PAN firewall, but I don't think there is any straight forward way to segregate unused objects i.e (address, address group, app group etc).

If there are features we currently don't have but you would like to see added, the Palo Alto SE can create a feature request for you.

Thanks

Re: How to identify unused objects?

gafrol — Thu, 28 Aug 2014 12:40:49 GMT

Firemon, Tufin, AlgoSec can help you

Re: How to identify unused objects?

cpainchaud — Thu, 28 Aug 2014 13:54:51 GMT

Hi,

Our Professional Services engineer do have some tools to make that happen. You could get in touch with your PAN Sales team to see what they can do for you.

Re: How to identify unused objects?

DaveCorwin — Thu, 28 Aug 2014 13:59:17 GMT

We are actually working with a Palo engineer right now who is creating a script to do this very thing. As stated above, there is nothing on the GUI or CLI that will perform this function, but you can script it out yourself.