Why do unused rules show traffic hits?

PeteHalatsis — Fri, 17 Jul 2020 18:21:29 GMT

I am doing cleanup of old unused firewall rules. Using the UNUSED policy optimizer I noticed that some rules are showing Traffic usage but 0 hits? Can someone explain why this is? I am wary to trust the HIT count until I understand the correlation. Best guess is that it tracks what apps would have hit it?

Re: Why do unused rules show traffic hits?

ShaiW — Sun, 19 Jul 2020 14:07:07 GMT

The firewall analyzes the traffic for each session. Let's say you browse to facebook-chat, your session starts with port 443 and the firewall finds a matching rule with application=any and service=tcp/443. When more session-data flows we see the application as facebook-base and search again for a rule this time matching application=facbeook-base - this is called application shifting.

My guess is the firewall sees some traffic on your rules but the final rule allowing or denying the application gets the 'hit' count increase.

Hope this help,

Shai

topic Re: Why do unused rules show traffic hits? in General Topics

Why do unused rules show traffic hits?

Re: Why do unused rules show traffic hits?