topic Impossible? List unused Addres Objects? in General Topics

Impossible? List unused Addres Objects?

RobinClayton — Fri, 23 Feb 2018 15:15:51 GMT

I assume there is no report to list address objects that have not been used

Ones that may or may not be in rules, relate to long dead or incorrectly entered endpoints, that have not generated any traffic.

I have seen the "Shared_dup_and_unused... script, but don't think that gives me the desired result.

Unless someone has something already, I think it's a new script to parse the traffic logs.

Cheers

Rob

Re: Impossible? List unused Addres Objects?

pulukas — Sat, 24 Feb 2018 18:59:27 GMT

Correct, no current feature. Do contact your sales engineer and vote for FR 3159.

PAN maintains an internal database of customer "Feature Requests" and each is assigned an ID number.

Companies can add the "vote" for specific requests via your sales engineer.

Highlight Unused Objects

FR 3159

Re: Impossible? List unused Addres Objects?

Retired Member — Mon, 26 Feb 2018 01:55:05 GMT

You can use the PANW Migration Tool;

https://live.paloaltonetworks.com/t5/Migration-Tool-Articles/MigrationTool-3-3-Info-and-Guide/ta-p/72559

Load a runnign config of your firewall(s) into that, and it has a section down the bottom of the 'Objects' tab to show/remove unused address objects

Re: Impossible? List unused Addres Objects?

RobinClayton — Mon, 26 Feb 2018 09:16:39 GMT

It's a while sice I have used the PAN migration tool, but I don't think it will do what I want.

The need is to find objects that may or may not be in a rule (not just ones that are not used in any rule) which have had no traffic logged from them.

As for logging it with our sales, I doubt they would ever pass it on and I doubt we will use them again!

Rob

Re: Impossible? List unused Addres Objects?

Remo — Sat, 03 Mar 2018 08:47:26 GMT

Hi @RobinClayton

As for a lot of topics without solution, the solution is the XML API.

If you really need something like that to check for used objects, you can write a script for doing exactly that:

Parse the ruleset for all the objects used
Lookup these objects in the configuration to get the ip address/subnet/IP range
Use the information from point 2 to query the logs for each object/address one by one and exclude the drop all policy in your query

Obviously depending on the size of the ruleset and the amount of objects this script can easily run for hours, but at the end you could have your custom object usage report.

Or use something like Tufin, to do this job. But even if you are not familiar with scripting, doing it by yourself is probably less expensive (unless you have other things wher Tufin would help you that are also time consuming)