Clarification on what is considered and "unused" object.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Clarification on what is considered and "unused" object.

L2 Linker

Can I get some clarification on what is considered an unused object?  

For example is an Address or Service Object considered unused if it is not part of any rules if it is listed individually and that is it?

How about if the object is not listed individually in any rules, but it is part of an object group that is also not part of any rules?

And finally, how about if the object is not listed individually in any rules, but is part of an object group and that object group is in fact included in a rule?

 

Thanks for the clarification.

1 accepted solution

Accepted Solutions

L6 Presenter

Hello BOkay,

Unused objects simply means address or service objects that's not being referenced in address group , service group , nat rules, and security rules.  If the address object is member of address group object , it will shows as "used" regardless if address group object is being referenced in any of the security or nat rules.  

View solution in original post

9 REPLIES 9

L6 Presenter

Hello BOkay,

Unused objects simply means address or service objects that's not being referenced in address group , service group , nat rules, and security rules.  If the address object is member of address group object , it will shows as "used" regardless if address group object is being referenced in any of the security or nat rules.  

Let me correct one thing.

If an address object is solely being used in address groups but those address groups are not used, the address object is not user as well.

We do a recursion to see if the object is actually needed for the security policy in place, including security rules, NAT rules, custom application rules, interfaces, etc. whether directly consumed of indirectly consumed by groups the object belongs to.

L1 Bithead

What about objects with tags that are a part of a dynamic address group?

Does Expedition take hit counts into account? I noticed a shared object that is added to a rule that is targeted to numerous firewalls in our Panorama shows as unused. It's very possible the rule doesn't have hit counts but going by the explanation above, it is used.

Hi @Alex_Kalbfell If the object is used in the dynamic objects , expedition would not know the reference , so it will show unused even it is tag and reference in the dynamic objects.  If you have dynamic objects, please review them carefully. 

Hi, I know this is an old thread but hoping to get some guidance. We have a few service groups that show up as "unused" objects, but we can see the service group is in use in a couple of active policies. Do you know how we may avoid this? Thanks in advance for your help.

 

Roderick De La Rosa
Information Security Analyst
Palo Alto NGFW Apasionado
AiOPs for NGFW Biggest Fan
Expedition Migration Tool Wizard

L2 Linker

Hi @RodyDeLaRosa  There is an option to recalculate the unused objects. The green button on bottom right in the objects tab.

L1 Bithead

Thank you very much for your reply, Abarbany. The recalculate button worked out the issue was that we tried to validate Expedition's denotation of one of our service groups using one of the NGFWs. We used global search to find the service group, and the firewall was identifying objects that contained the string, not policies that used this service group. Once we hovered over those results in global search we noticed that the service group was not used in the policy, the policy just contained the same string in the name. Good to know that Expedition is that accurate.

 

Roderick De La Rosa
Information Security Analyst
Palo Alto NGFW Apasionado
AiOPs for NGFW Biggest Fan
Expedition Migration Tool Wizard

This seems short sighted and fairly easy to have Expedition test. Expedition knows what tags are referenced in the dynamic group, and what tags the address object has assigned and can make that calculation. How do I propose a change/improvement to Expedition?

Hi @MatthewSabin 

Thanks for reaching out.

Let me take note of this request.

Appreciate your feedback.

Best,

David 

  • 1 accepted solution
  • 4866 Views
  • 9 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!