- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
02-23-2015 11:11 AM
Hi,
I'm doing maintenance and have doubts about a NAT rule.
I have enabled the "Highlight Unused Rules" and this rule seems to be that using currently. But we believe that this is not in use.
How can I see the activity related to a policy NAT?
How can I see that affects this rule?
How can I check the activity NAT using CLI?
Thanks and regards,
02-23-2015 01:31 PM
Hi CoS
You can check the sessions from CLI using the below command:
show session all filter nat-rule <rule-name>
To see what NAT rules are matched for a specific traffic you can also use the test command:
test nat-policy-match <criteria>
02-23-2015 02:19 PM
Hello Cos,
It looks the "Highlight unused rule" option is working for Security Policy but not for the NAT policy on my PAN firewall. So, the CLI command mentioned by bat would the right way to determine it.
Thanks
02-23-2015 02:28 PM
Hello COS,
Please find below the observed behavior:
I have added new NAT rules. Before commit, if iclick into the "Highlight unused rule", The feature works as expected. However, once commit is done in the PA, it is not highlighted.
There is a BUG open for this:
Bug 65553 - After commit, Highlight Unused Rules does not wroks for NAT rules
Resolved in:PAN OS 6.1.2
Hope this helps.
Thanks
02-23-2015 04:31 PM
Thanks for letting us know the bug id and resolution version.
02-24-2015 05:54 AM
Hello COS,
If the rule is been used atleast once, we cannot reset the counter unless a restart is done.
We can however change the name of the existing NAT/Policy rule ( "X" to "X-1"), This will again wait for a new packet to hit the rule, so that the "highlight unused" feature will work.
If it is a Rule constantly getting used(example Dynamic ISP NAT), it will be very hard to use the highlight unused feature.
02-24-2015 03:13 PM
Also keep in mind that it will only highlight unused rules since the last reboot. But it sounds like the bug maybe causing it.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!