Create Custom Report for Unused Rules

[marek.kolonicny]

Hi

I am struggling a bit here. 

I've been tasked to set up various reports on palo firewall. 

One of them is to create a custom report displaying all unused rules. 

I've tried many things. I followed this link: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcgCAC

which basically creates a report of used rules. I need exactly the opposite. 

I've tried to use the query builder to set packet, bytes or count to zero hoping that I will be given a list of unused rules. Unfortunately it didn't work and I get "No matching records". 

Anyone has any ideas how to achieve this?

Thank you

[jdelio]

At the bottom of your policies page, you can always just select "Highlight Unused Rules"

We even have a Tips and Tricks article on this:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVICA0

If that will not suffice, then let me know and I will see if there is any other way here.

[jdelio]

 a couple of more things.. if you wanted something via the CLI which may be easier to read.. you can try this command:

show running rule-use rule-base <option> type unused vsys vsys1

That command will give you, in my opinion, an easier to read list than what the GUI is capable of giving you.