topic Re: Reporting on Security/NAT Polcies and Hit Counts in General Topics

Reporting on Security/NAT Polcies and Hit Counts

WillWylie — Fri, 06 Nov 2015 16:45:19 GMT

Is there a way to export the current Security and NAT Policies to CSV, or even just PDF?

I need to clean up a dirty firewall that I inherited, but I need other teams to let me know what is active/inactive. Screenshots or CLI outputs can work, but I want to provide this in a clear table format that is usable.

I'd also like to know if there is a way to see the amount of times a rule is hit, I know I could do this through the monitor tab, but that is a cumbersome way to provide that information.

Re: Reporting on Security/NAT Polcies and Hit Counts

glastra1 — Fri, 06 Nov 2015 19:12:23 GMT

Bets 2 answer I know,

https://live.paloaltonetworks.com/t5/General-Topics/PAN-OS-4-0-4-Rule-hit-counts/m-p/19226/highlight/true#M14029

https://live.paloaltonetworks.com/t5/SDK-API-Articles/PHP-Script-to-trend-Security-Policy-hits-using-the-XML-API/ta-p/59964

Regards,

Gerardo.

Re: Reporting on Security/NAT Polcies and Hit Counts

WillWylie — Mon, 09 Nov 2015 15:45:33 GMT

Unfortunately, neither of those seem to work. The hit "report" can't be generated in 7.0.x.

Re: Reporting on Security/NAT Polcies and Hit Counts

jdelio — Mon, 09 Nov 2015 22:27:42 GMT

If you are using PAN-OS 7.0, then inside of the redesigned ACC, there is a section "Rule Usage"

Inside there it allows you to see in detail how much the rules are used based upon sessions, bytes, etc.

It does not appear that you can see the NAT usage, just the Security Policy.

I hope this helps.

Re: Reporting on Security/NAT Polcies and Hit Counts

WillWylie — Tue, 10 Nov 2015 13:44:55 GMT

Close. I can see the session count, but it looks like it's limited to the top 15?

Re: Reporting on Security/NAT Polcies and Hit Counts

jdelio — Thu, 12 Nov 2015 22:34:54 GMT

I was digging around a little.. and discovered the CLI to show this info..

> show running rule-use rule-base security type unused vsys vsys1 (replace vsys1 with the appropriate vsys name)

This was actually inside of this article:

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-View-Bytes-Session-Usage-of-Security-Policies/ta-p/55186

I hope this helps.