PBF: unused rules

[bdeschut]

Hey all,

I am using multiple PBF rules and am 100% sure that nearly half of them have been hit after the last reboot. However, when I select "Highlight unused rules", it highlights all my rules..

Anyone else seeing this?

Kind regards,

Bob

[hyadavalli]

Hello Bob,

The best way to make sure your PBF rules are hit in GUI is to pull down another column 'Egress IF' in traffic logs and verify the traffic is going out on the interface you specified in pbf policy.

Other way to check is through CLI command.

>show pbf rule all

Make sure all rules are active.

>test pbf-policy-match source <ip-address> destination <ip-address> protocol <number> destination-port <number>.

Regards,

Hari Yadavalli

[bdeschut]

Yes, I know, that's how I was 100% sure that the rules were being hit.

But it made no sense to me that they were highlighted as unused and was wondering if this is a bug or not.

Kind regards,

Bob

[hyadavalli]

Hello Bob,

There was a known issue related to highlight unused rules and fixed in OS version 4.1.8.

Can you confirm the OS version?

Regards,

Hari Yadavalli

[bdeschut]

Hey,

PANOS 5.0.3

Kind regards

[Phoenix]

Hello,

Have you tried to run the below command and see the results,

"show running rule-use rule-base pbf type unused vsys vsys1"

Would the results look different from the GUI. Pls share.

Thanks