Clarification on what is considered and "unused" object.

[BOkay]

Can I get some clarification on what is considered an unused object?  

For example is an Address or Service Object considered unused if it is not part of any rules if it is listed individually and that is it?

How about if the object is not listed individually in any rules, but it is part of an object group that is also not part of any rules?

And finally, how about if the object is not listed individually in any rules, but is part of an object group and that object group is in fact included in a rule?

Thanks for the clarification.

[lychiang · Accepted solution]

Hello BOkay,

Unused objects simply means address or service objects that's not being referenced in address group , service group , nat rules, and security rules.  If the address object is member of address group object , it will shows as "used" regardless if address group object is being referenced in any of the security or nat rules.  

[dgildelaig]

Let me correct one thing.

If an address object is solely being used in address groups but those address groups are not used, the address object is not user as well.

We do a recursion to see if the object is actually needed for the security policy in place, including security rules, NAT rules, custom application rules, interfaces, etc. whether directly consumed of indirectly consumed by groups the object belongs to.

[Alex_Kalbfell]

What about objects with tags that are a part of a dynamic address group?

Does Expedition take hit counts into account? I noticed a shared object that is added to a rule that is targeted to numerous firewalls in our Panorama shows as unused. It's very possible the rule doesn't have hit counts but going by the explanation above, it is used.

[lychiang]

Hi @Alex_Kalbfell If the object is used in the dynamic objects , expedition would not know the reference , so it will show unused even it is tag and reference in the dynamic objects.  If you have dynamic objects, please review them carefully. 

[RodyDeLaRosa]

Hi, I know this is an old thread but hoping to get some guidance. We have a few service groups that show up as "unused" objects, but we can see the service group is in use in a couple of active policies. Do you know how we may avoid this? Thanks in advance for your help.

[abarbany]

Hi @RodyDeLaRosa  There is an option to recalculate the unused objects. The green button on bottom right in the objects tab.

[RodyDeLaRosa]

Thank you very much for your reply, Abarbany. The recalculate button worked out the issue was that we tried to validate Expedition's denotation of one of our service groups using one of the NGFWs. We used global search to find the service group, and the firewall was identifying objects that contained the string, not policies that used this service group. Once we hovered over those results in global search we noticed that the service group was not used in the policy, the policy just contained the same string in the name. Good to know that Expedition is that accurate.

[MatthewSabin]

This seems short sighted and fairly easy to have Expedition test. Expedition knows what tags are referenced in the dynamic group, and what tags the address object has assigned and can make that calculation. How do I propose a change/improvement to Expedition?

[dpuigdomenec]

Hi @MatthewSabin 

Thanks for reaching out.

Let me take note of this request.

Appreciate your feedback.

Best,

David