Firewall rule auditng

[jdprovine]

Has any body have a procedure on how to audit and remove rules? We have alot of what appears to be unused rules so far I disable them, date when I disabled them and then a 30 days and then delete them. let me know if any one has any better method or suggestions

[OtakarKlier]

Hello,

We pretty much do the same as you due. We are reuired to review our firewall configurations monthly so its routine for us. The other thing I do when I disable a rule, is move it all the way to the bottom, just so i dont have to hunt for them later.

I know its not much help but I am too curious as to what others do.

Cheers!

[gwesson]

I've seen some people disable them and add a new tag (something like "pending-removal"). Doing that allows you to easily filter them, and you can leave them in place because the filtering mechanism allows you to just show rules that have the tag. You can even use tags to say, mark one as "future-delete" or some such.

If you can't use tags, the description can also be used for this purpose. Normally it's not shown on the Security rules, but it is a filterable field:

(description contains 'deleteme') 

Cheers,

Greg

[jdprovine]

Yeah I was thinking of moving all the unused rules to the botton or at least tagging them. So do you wait a full month before deleting them?

[jdprovine]

I thought about tagging them and that seems like a good idea. So do you wait a full month before deleting them

[kiwi]

There's the 'Highlight Unused Rules' checkbox.

The rules not used since the dataplane started up will be highlighted.

Using the CLI you have this command :

> show running rule-use rule-base security type unused vsys vsys1

As with the GUI, rules not used since the dataplane started up will be listed.

Check both the following articles on the topic :

How to Identify Unused Policies on a Palo Alto Networks Device

Tips & Tricks : Highlight UnusedRules

Hope this helps,

-Kim.

[jdprovine]

One other thing do you schedule your audit before or after a reboot and why?

[jdprovine]

So do you do your firewall rule before or after a reboot?

[OtakarKlier]

Hello,

We only reboot our firewalls for code upgrades, usually quarterly.

Regards,

[jdprovine]

Yes we do the same thing but I know that the rules change and the unused aspect gets reset after a reboot. So is it more reliable to base the rule disable on the status before or after a reboot?

[OtakarKlier]

I would say it depends and you also have to be careful. If a legit rules is not hit but it requried, then you could block legitimate traffic. But then again if you systems are being probed, the rule may show that its being used when you really dont want it to.

I know these answers are a bit vague, but I think the key is to tread lightly as not to cause outages. Not sure how big the shop you work in is, but in the past we would have review meetings with multiple people from the team and go over the policies to make sure they were still legit.

Cheers!