topic Re: NAT Rules Log / Highlight Unused Rules in General Topics

NAT Rules Log / Highlight Unused Rules

SOC_CSG — Mon, 23 Feb 2015 19:11:33 GMT

Hi,

I'm doing maintenance and have doubts about a NAT rule.

I have enabled the "Highlight Unused Rules" and this rule seems to be that using currently. But we believe that this is not in use.

How can I see the activity related to a policy NAT?

How can I see that affects this rule?

How can I check the activity NAT using CLI?

Thanks and regards,

Re: NAT Rules Log / Highlight Unused Rules

bat — Mon, 23 Feb 2015 21:31:09 GMT

Hi CoS

You can check the sessions from CLI using the below command:

show session all filter nat-rule <rule-name>

To see what NAT rules are matched for a specific traffic you can also use the test command:

test nat-policy-match <criteria>

Re: NAT Rules Log / Highlight Unused Rules

HULK — Mon, 23 Feb 2015 22:19:02 GMT

Hello Cos,

It looks the "Highlight unused rule" option is working for Security Policy but not for the NAT policy on my PAN firewall. So, the CLI command mentioned by bat would the right way to determine it.

Thanks

Re: NAT Rules Log / Highlight Unused Rules

HULK — Mon, 23 Feb 2015 22:28:36 GMT

Hello COS,

Please find below the observed behavior:

I have added new NAT rules. Before commit, if iclick into the "Highlight unused rule", The feature works as expected. However, once commit is done in the PA, it is not highlighted.

There is a BUG open for this:

Bug 65553 - After commit, Highlight Unused Rules does not wroks for NAT rules

Resolved in:PAN OS 6.1.2

Hope this helps.

Thanks

Re: NAT Rules Log / Highlight Unused Rules

pulukas — Tue, 24 Feb 2015 00:31:04 GMT

Thanks for letting us know the bug id and resolution version.

Re: NAT Rules Log / Highlight Unused Rules

RajeshB — Tue, 24 Feb 2015 13:54:14 GMT

Hello COS,

If the rule is been used atleast once, we cannot reset the counter unless a restart is done.

We can however change the name of the existing NAT/Policy rule ( "X" to "X-1"), This will again wait for a new packet to hit the rule, so that the "highlight unused" feature will work.

If it is a Rule constantly getting used(example Dynamic ISP NAT), it will be very hard to use the highlight unused feature.

Re: NAT Rules Log / Highlight Unused Rules

oklier — Tue, 24 Feb 2015 23:13:05 GMT

Also keep in mind that it will only highlight unused rules since the last reboot. But it sounds like the bug maybe causing it.