I'm doing maintenance and have doubts about a NAT rule.
I have enabled the "Highlight Unused Rules" and this rule seems to be that using currently. But we believe that this is not in use.
How can I see the activity related to a policy NAT?
How can I see that affects this rule?
How can I check the activity NAT using CLI?
Thanks and regards,
You can check the sessions from CLI using the below command:
show session all filter nat-rule <rule-name>
To see what NAT rules are matched for a specific traffic you can also use the test command:
test nat-policy-match <criteria>
It looks the "Highlight unused rule" option is working for Security Policy but not for the NAT policy on my PAN firewall. So, the CLI command mentioned by bat would the right way to determine it.
Please find below the observed behavior:
I have added new NAT rules. Before commit, if iclick into the "Highlight unused rule", The feature works as expected. However, once commit is done in the PA, it is not highlighted.
There is a BUG open for this:
Bug 65553 - After commit, Highlight Unused Rules does not wroks for NAT rules
Resolved in:PAN OS 6.1.2
Hope this helps.
Thanks for letting us know the bug id and resolution version.
If the rule is been used atleast once, we cannot reset the counter unless a restart is done.
We can however change the name of the existing NAT/Policy rule ( "X" to "X-1"), This will again wait for a new packet to hit the rule, so that the "highlight unused" feature will work.
If it is a Rule constantly getting used(example Dynamic ISP NAT), it will be very hard to use the highlight unused feature.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!