Firewall rule auditng

Showing results for 
Search instead for 
Did you mean: 

Firewall rule auditng

L4 Transporter

Has any body have a procedure on how to audit and remove rules? We have alot of what appears to be unused rules so far I disable them, date when I disabled them and then a 30 days and then delete them. let me know if any one has any better method or suggestions


Cyber Elite
Cyber Elite


We pretty much do the same as you due. We are reuired to review our firewall configurations monthly so its routine for us. The other thing I do when I disable a rule, is move it all the way to the bottom, just so i dont have to hunt for them later.


I know its not much help but I am too curious as to what others do.



I've seen some people disable them and add a new tag (something like "pending-removal"). Doing that allows you to easily filter them, and you can leave them in place because the filtering mechanism allows you to just show rules that have the tag. You can even use tags to say, mark one as "future-delete" or some such.


If you can't use tags, the description can also be used for this purpose. Normally it's not shown on the Security rules, but it is a filterable field:

(description contains 'deleteme') 




Yeah I was thinking of moving all the unused rules to the botton or at least tagging them. So do you wait a full month before deleting them?

I thought about tagging them and that seems like a good idea. So do you wait a full month before deleting them

Community Team Member

There's the 'Highlight Unused Rules' checkbox.


The rules not used since the dataplane started up will be highlighted.


Using the CLI you have this command :


> show running rule-use rule-base security type unused vsys vsys1


As with the GUI, rules not used since the dataplane started up will be listed.


Check both the following articles on the topic :

How to Identify Unused Policies on a Palo Alto Networks Device

Tips & Tricks : Highlight UnusedRules


Hope this helps,


LIVEcommunity team member, CISSP
Don't forget to hit that Like button if a post is helpful to you!

One other thing do you schedule your audit before or after a reboot and why?

So do you do your firewall rule before or after a reboot?


We only reboot our firewalls for code upgrades, usually quarterly.



Yes we do the same thing but I know that the rules change and the unused aspect gets reset after a reboot. So is it more reliable to base the rule disable on the status before or after a reboot?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!