Firewall rule optimization

[jdprovine]

Anyone know of any good firewall optimization software for PA. One that can review the rules and make good suggestion to improve the rule order, removal etc?

[googol]

Company called Firemon has a product that assists with this.

https://www.firemon.com/

[jdprovine]

I assume firemon has a price, anyone know of an open source version as well to look at?

[Kalemegdan]

I was in the same boat as you are; inherited about 850 lines of sec policies being migrated from other vendor's solution. My apporach to clean/optimize was to enable "Hightlight unused rules" and after a month i started disabling unused rules. Waited another month, documented disabled rules and scheduled rule removeal. And four more weekends like that. It took me about 2 months to reduce number of rules from 850 to 200. In the same time this excersise allowed me to get better understanding of the infrastructure. Out of all those disabled rules, i had 10 rules thate were required to put back; some legacy traffic users were not aware of.

You might be able to use PAN migration tool to upload firewall config and see if any duplication is showing. 

[jdprovine]

Well the migration was complete a couple of months ago and I have been using the method that you mentioned but I was also told there is software out there that would be able to do some of that work for me. So I just thought I would see waht people are using and how they like it. So far the only suggestion I have had is firemon, I am probably going to download a trial of that and see what it does, but would love more suggestions 

[Kalemegdan]

If you dont mind, once you downlaod and test software could you post your findings? 

[jdprovine]

I can try it may not be something that can easlily be posted verbatim and it may take quite some time to complete the testing