Firewall rule auditng

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Firewall rule auditng

L4 Transporter

Has any body have a procedure on how to audit and remove rules? We have alot of what appears to be unused rules so far I disable them, date when I disabled them and then a 30 days and then delete them. let me know if any one has any better method or suggestions

10 REPLIES 10

Cyber Elite
Cyber Elite

Hello,

We pretty much do the same as you due. We are reuired to review our firewall configurations monthly so its routine for us. The other thing I do when I disable a rule, is move it all the way to the bottom, just so i dont have to hunt for them later.

 

I know its not much help but I am too curious as to what others do.

 

Cheers!

I've seen some people disable them and add a new tag (something like "pending-removal"). Doing that allows you to easily filter them, and you can leave them in place because the filtering mechanism allows you to just show rules that have the tag. You can even use tags to say, mark one as "future-delete" or some such.

 

If you can't use tags, the description can also be used for this purpose. Normally it's not shown on the Security rules, but it is a filterable field:

(description contains 'deleteme') 

 

Cheers,

Greg

Yeah I was thinking of moving all the unused rules to the botton or at least tagging them. So do you wait a full month before deleting them?

I thought about tagging them and that seems like a good idea. So do you wait a full month before deleting them

Community Team Member

There's the 'Highlight Unused Rules' checkbox.

 

The rules not used since the dataplane started up will be highlighted.

 

Using the CLI you have this command :

 

> show running rule-use rule-base security type unused vsys vsys1

 

As with the GUI, rules not used since the dataplane started up will be listed.

 

Check both the following articles on the topic :

How to Identify Unused Policies on a Palo Alto Networks Device

Tips & Tricks : Highlight UnusedRules

 

Hope this helps,

-Kim.

LIVEcommunity team member, CISSP
Cheers,
Kiwi
Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

One other thing do you schedule your audit before or after a reboot and why?

So do you do your firewall rule before or after a reboot?

Hello,

We only reboot our firewalls for code upgrades, usually quarterly.

 

Regards,

Yes we do the same thing but I know that the rules change and the unused aspect gets reset after a reboot. So is it more reliable to base the rule disable on the status before or after a reboot?

I would say it depends and you also have to be careful. If a legit rules is not hit but it requried, then you could block legitimate traffic. But then again if you systems are being probed, the rule may show that its being used when you really dont want it to.

 

I know these answers are a bit vague, but I think the key is to tread lightly as not to cause outages. Not sure how big the shop you work in is, but in the past we would have review meetings with multiple people from the team and go over the policies to make sure they were still legit.

 

Cheers!

  • 3644 Views
  • 10 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!