Clean Firewall Policies

[tombombadil]

Hello all,

I am thinking of how can i clean/organize my firewall policies. Many rules seem to be mixed up within each other. Do you have any suggestions to make it more appealing to the eye? How should I organize my rules?

[SutareMayur]

Hi @tombombadil 

Firewall security policies is a bit complex and lengthy process because you can't delete/update any rules right away. This might create an issue or outages at times. Though it is a lengthy process, if you follow right process, eventually you can optimize the ruleset.

I would recommend you to look for below rules first and see if you really need those rules. At times, you might need to monitor the rules for some time period to see if is it really being used.

Also, when you find any rule to be clean up as not used since long or never used at all, DO NOT DELETE SUCH RULE/S RIGHT AWAY. BEST PRACTICE IS TO DISABLE IT FOR SOME PERIOD AND SEE IF ANYONE REPORTS ANY ISSUES. IF NOTHING COMES THEN YOU CAN DELETE IT.

1. Check for Over permissive rules. E.g. rules with ANY ports/apps and/or source/destinations.

2. Check for unused or not used in recent time rules based on the hit counts on the rule.

3. Check and try to use Security Policy Optimizer.  This will help you to optimize your rule base efficiently.

Security Policy Optimizer

Security Policy Optimization

Hope it helps!

[tombombadil]

Hi @SutareMayur,

Thanks for your advices. After the cleaning my rules, I want to order them and I want to collect my rules in subfields. Such as, SSL VPN rules will be in part, LAN-WAN rules in a part. How can I organize my rule base ?