topic Re: Firewall rule optimization in General Topics

Firewall rule optimization

jdprovine — Fri, 04 Dec 2015 14:40:51 GMT

Anyone know of any good firewall optimization software for PA. One that can review the rules and make good suggestion to improve the rule order, removal etc?

Re: Firewall rule optimization

googol — Fri, 04 Dec 2015 14:48:27 GMT

Company called Firemon has a product that assists with this.

https://www.firemon.com/

Re: Firewall rule optimization

jdprovine — Fri, 04 Dec 2015 16:28:09 GMT

I assume firemon has a price, anyone know of an open source version as well to look at?

Re: Firewall rule optimization

Kalemegdan — Mon, 07 Dec 2015 22:01:30 GMT

I was in the same boat as you are; inherited about 850 lines of sec policies being migrated from other vendor's solution. My apporach to clean/optimize was to enable "Hightlight unused rules" and after a month i started disabling unused rules. Waited another month, documented disabled rules and scheduled rule removeal. And four more weekends like that. It took me about 2 months to reduce number of rules from 850 to 200. In the same time this excersise allowed me to get better understanding of the infrastructure. Out of all those disabled rules, i had 10 rules thate were required to put back; some legacy traffic users were not aware of.

You might be able to use PAN migration tool to upload firewall config and see if any duplication is showing.

Re: Firewall rule optimization

jdprovine — Tue, 08 Dec 2015 15:40:02 GMT

Well the migration was complete a couple of months ago and I have been using the method that you mentioned but I was also told there is software out there that would be able to do some of that work for me. So I just thought I would see waht people are using and how they like it. So far the only suggestion I have had is firemon, I am probably going to download a trial of that and see what it does, but would love more suggestions

Re: Firewall rule optimization

Kalemegdan — Tue, 08 Dec 2015 21:20:37 GMT

If you dont mind, once you downlaod and test software could you post your findings?

Re: Firewall rule optimization

jdprovine — Tue, 08 Dec 2015 22:08:30 GMT

I can try it may not be something that can easlily be posted verbatim and it may take quite some time to complete the testing