topic Re: Cleaning obsolete firewall rules in General Topics

Cleaning obsolete firewall rules

peterpan13888 — Mon, 07 Oct 2013 21:34:04 GMT

Hi all,

We have recently migrated from Juniper to Palo Alto firewall and there are numerous firewall rules that are obsolete and potentially a security risk to me. I tried to use "highlight unused rules" button but it does not seem consistent to me. Are the highlighted rules unused since the firewalls start running or simply not currently used at the moment now? (There is a big difference between the two).

Thanks a lot!!

Re: Cleaning obsolete firewall rules

ukhapre — Mon, 07 Oct 2013 22:33:39 GMT

Hello,You should wait for some time after migration to allow firewall analyze ununsed rules.

The show unused rules are tied to the Monitor Logs, so if you are not having good history of logs, then all the rules will be marked as unused rules.

I believe that is why you see inconsistent results.

FYI only

Below is command to pull a list

>show running rule-use rule-base security type unused vsys vsys1

Hope this helps!

Please mark it as correct answer or helpful if appropriate.

Re: Cleaning obsolete firewall rules

zarina — Tue, 08 Oct 2013 21:35:33 GMT

"highlight unused rules" shows the rules that are not used by the device since the start of the dataplane.

Re: Cleaning obsolete firewall rules

peterpan13888 — Thu, 10 Oct 2013 14:21:44 GMT

Thanks the replies. It is crystal clear to me know.