Create Custom Report for Unused Rules

[marek.kolonicny]

Hi

I am struggling a bit here. 

I've been tasked to set up various reports on palo firewall. 

One of them is to create a custom report displaying all unused rules. 

I've tried many things. I followed this link: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcgCAC

which basically creates a report of used rules. I need exactly the opposite. 

I've tried to use the query builder to set packet, bytes or count to zero hoping that I will be given a list of unused rules. Unfortunately it didn't work and I get "No matching records". 

Anyone has any ideas how to achieve this?

Thank you

[jdelio]

At the bottom of your policies page, you can always just select "Highlight Unused Rules"

We even have a Tips and Tricks article on this:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVICA0

If that will not suffice, then let me know and I will see if there is any other way here.

[jdelio]

 a couple of more things.. if you wanted something via the CLI which may be easier to read.. you can try this command:

show running rule-use rule-base <option> type unused vsys vsys1

That command will give you, in my opinion, an easier to read list than what the GUI is capable of giving you. 

[sanalto]

Hello,

We are managing over 100 firewalls through Panorama and need to generate a report of unused rules across all firewalls managed by all Panoramas. I haven’t been able to find any specific documentation or procedure for this.

Could someone guide us on the steps required to accomplish this?

Thanks.

[kiwi]

Hi @sanalto ,

How about this doc:

https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/device-monitoring-on...

Hope this helps,

[sanalto]

Hi,

The shared document only outlines the steps to configure and view the hit count for individual policy rules. It does not provide guidance on generating a report of all unused rules across the managed firewalls from Panorama.

Thanks.