How Does the "Highlight Unused Rules" Option Work on Panorama?

[CHammock]

As far as I am aware Panorama doesn't have counters so are the unused rules identified based on counters or similar from the devices in the device-group or based on traffic logs?

[kadak · Accepted solution]

Hello CHammock

Each managed device maintains a flag for the rules that have a match. Panorama monitors each device, fetches and aggregrates the list of  rules that do no have a match. On managed firewalls, that flag is reset when a dataplane reset occurs on a reboot or a restart,

Hope that helps!

Thanks and regards,

Kunal Adak

[CHammock]

That is perfect exactly what I thought would happen, as in its logical and consistent.  So the fact that my panorama logs are rolling every month won't affect the highlight unused rules.

[DMast]

In an Active/Passive device pair NOT managed by panorama, would the flag be synchronized between devices?

[minow]

i also noticed that this Flag is match to a rule by its "name" so if you changed the rule name it will be marked with no hits