Cleaning obsolete firewall rules

[peterpan13888]

Hi all,

We have recently migrated from Juniper to Palo Alto firewall and there are numerous firewall rules that are obsolete and potentially a security risk to me. I tried to use "highlight unused rules" button but it does not seem consistent to me. Are the highlighted rules unused since the firewalls start running or simply not currently used at the moment now? (There is a big difference between the two).

Thanks a lot!!

[ukhapre]

Hello,You should wait for some time after migration to allow firewall analyze ununsed rules.

The show unused rules are tied to the Monitor Logs, so if you are not having good history of logs, then all the rules will be marked as unused rules.

I believe that is why you see inconsistent results.

FYI only

Below is command to pull a list

>show running rule-use rule-base security type unused vsys vsys1

Hope this helps!

Please mark it as correct answer or helpful if appropriate.

[zarina]

"highlight unused rules" shows the rules that are not used by the device since the start of the dataplane.

[peterpan13888]

Thanks the replies. It is crystal clear to me know.