topic Re: PBF: unused rules in General Topics

PBF: unused rules

${userLoginName} — Wed, 20 Nov 2013 09:21:22 GMT

Hey all,

I am using multiple PBF rules and am 100% sure that nearly half of them have been hit after the last reboot. However, when I select "Highlight unused rules", it highlights all my rules..

Anyone else seeing this?

Kind regards,

Bob

Re: PBF: unused rules

hyadavalli — Wed, 20 Nov 2013 12:43:14 GMT

Hello Bob,

The best way to make sure your PBF rules are hit in GUI is to pull down another column 'Egress IF' in traffic logs and verify the traffic is going out on the interface you specified in pbf policy.

Other way to check is through CLI command.

>show pbf rule all

Make sure all rules are active.

>test pbf-policy-match source <ip-address> destination <ip-address> protocol <number> destination-port <number>.

Regards,

Hari Yadavalli

Re: PBF: unused rules

${userLoginName} — Wed, 20 Nov 2013 12:51:00 GMT

Yes, I know, that's how I was 100% sure that the rules were being hit.

But it made no sense to me that they were highlighted as unused and was wondering if this is a bug or not.

Kind regards,

Bob

Re: PBF: unused rules

hyadavalli — Wed, 20 Nov 2013 13:23:42 GMT

Hello Bob,

There was a known issue related to highlight unused rules and fixed in OS version 4.1.8.

Can you confirm the OS version?

Regards,

Hari Yadavalli

Re: PBF: unused rules

${userLoginName} — Wed, 20 Nov 2013 14:57:57 GMT

Hey,

PANOS 5.0.3

Kind regards

Re: PBF: unused rules

Phoenix — Wed, 20 Nov 2013 17:51:48 GMT

Hello,

Have you tried to run the below command and see the results,

"show running rule-use rule-base pbf type unused vsys vsys1"

Would the results look different from the GUI. Pls share.

Thanks