topic CLI command to get the unused/zero hits security policy. in General Topics

CLI command to get the unused/zero hits security policy.

sandeep.paul — Sat, 23 Dec 2017 12:13:00 GMT

I see unused check box on GUI, what is the command to get similar results on CLI

Re: CLI command to get the unused/zero hits security policy.

BPry — Sun, 24 Dec 2017 03:19:26 GMT

@sandeep.paul

show running rule-use rule-base <option> type unused vsys vsys1

That command will give you, in my opinion, an easier to read list than what the GUI is capable of giving you.

Re: CLI command to get the unused/zero hits security policy.

sandeep.paul — Thu, 04 Jan 2018 08:52:43 GMT

Thanks BPry

Re: CLI command to get the unused/zero hits security policy.

sandeep.paul — Sat, 06 Jan 2018 01:43:30 GMT

Does tho command show unused policies since last reboot? Is there any duration or how far it checks on the unused policies. Please let me know.

Re: CLI command to get the unused/zero hits security policy.

BPry — Sat, 06 Jan 2018 01:48:05 GMT

@sandeep.paul,
Correct. That command, and the firewall in general, is only going to be able to tell you if the policy has been used since the device was last restarted. Once you restart all of your rules will become unused until they actually match to another session.

Re: CLI command to get the unused/zero hits security policy.

sandeep.paul — Sat, 06 Jan 2018 02:02:28 GMT

Thanks, is there any command that we will know if sec policy is not being used from Day it was configured?

Re: CLI command to get the unused/zero hits security policy.

Brandon_Wertz — Mon, 08 Jan 2018 18:46:27 GMT

@sandeep.paul wrote:
Thanks, is there any command that we will know if sec policy is not being used from Day it was configured?

Unfortunately no