topic Re: Firewall rule auditng in General Topics

Firewall rule auditng

jdprovine — Fri, 29 Jan 2016 21:56:26 GMT

Has any body have a procedure on how to audit and remove rules? We have alot of what appears to be unused rules so far I disable them, date when I disabled them and then a 30 days and then delete them. let me know if any one has any better method or suggestions

Re: Firewall rule auditng

OtakarKlier — Fri, 29 Jan 2016 23:56:40 GMT

Hello,

We pretty much do the same as you due. We are reuired to review our firewall configurations monthly so its routine for us. The other thing I do when I disable a rule, is move it all the way to the bottom, just so i dont have to hunt for them later.

I know its not much help but I am too curious as to what others do.

Cheers!

Re: Firewall rule auditng

gwesson — Sat, 30 Jan 2016 00:11:35 GMT

I've seen some people disable them and add a new tag (something like "pending-removal"). Doing that allows you to easily filter them, and you can leave them in place because the filtering mechanism allows you to just show rules that have the tag. You can even use tags to say, mark one as "future-delete" or some such.

If you can't use tags, the description can also be used for this purpose. Normally it's not shown on the Security rules, but it is a filterable field:

(description contains 'deleteme')

Cheers,

Greg

Re: Firewall rule auditng

jdprovine — Mon, 01 Feb 2016 14:13:45 GMT

Yeah I was thinking of moving all the unused rules to the botton or at least tagging them. So do you wait a full month before deleting them?

Re: Firewall rule auditng

jdprovine — Mon, 01 Feb 2016 14:14:41 GMT

I thought about tagging them and that seems like a good idea. So do you wait a full month before deleting them

Re: Firewall rule auditng

kiwi — Mon, 01 Feb 2016 14:14:56 GMT

There's the 'Highlight Unused Rules' checkbox.

The rules not used since the dataplane started up will be highlighted.

Using the CLI you have this command :

> show running rule-use rule-base security type unused vsys vsys1

As with the GUI, rules not used since the dataplane started up will be listed.

Check both the following articles on the topic :

How to Identify Unused Policies on a Palo Alto Networks Device

Tips & Tricks : Highlight UnusedRules

Hope this helps,

-Kim.

Re: Firewall rule auditng

jdprovine — Mon, 01 Feb 2016 14:16:20 GMT

One other thing do you schedule your audit before or after a reboot and why?

Re: Firewall rule auditng

jdprovine — Mon, 01 Feb 2016 21:43:22 GMT

So do you do your firewall rule before or after a reboot?

Re: Firewall rule auditng

OtakarKlier — Mon, 01 Feb 2016 21:47:31 GMT

Hello,

We only reboot our firewalls for code upgrades, usually quarterly.

Regards,

Re: Firewall rule auditng

jdprovine — Mon, 01 Feb 2016 22:06:38 GMT

Yes we do the same thing but I know that the rules change and the unused aspect gets reset after a reboot. So is it more reliable to base the rule disable on the status before or after a reboot?

Re: Firewall rule auditng

OtakarKlier — Mon, 01 Feb 2016 22:10:58 GMT

I would say it depends and you also have to be careful. If a legit rules is not hit but it requried, then you could block legitimate traffic. But then again if you systems are being probed, the rule may show that its being used when you really dont want it to.

I know these answers are a bit vague, but I think the key is to tread lightly as not to cause outages. Not sure how big the shop you work in is, but in the past we would have review meetings with multiple people from the team and go over the policies to make sure they were still legit.

Cheers!