topic Re: Identify shadow rules in Firewall and Security Management

Identify shadow rules

aharihara — Tue, 22 Nov 2022 12:41:44 GMT

Is there a way to identify the shadow or redundant rules? I have used Algosec with a different customer, with latest R81.x I heard that Algosec is not feasible because of the layers and zone based policies. There are few thousands of rules that need to be reconciled across multiple gateways and I need to know a way to do this effectively. Has anyone been in a similar situation and has a solution for this?

Thanks!

Re: Identify shadow rules

Chris_Atkinson — Tue, 22 Nov 2022 12:51:02 GMT

SmartOptimize or other analysis leveraging the APIs seem like the most logical approach.

sk161574 may also be relevant here.

Re: Identify shadow rules

PhoneBoy — Tue, 22 Nov 2022 17:22:22 GMT

One common optimization tactic is to eliminate rules that have zero hit count.
There is a script for that: https://community.checkpoint.com/t5/API-CLI-Discussion/Disable-Delete-Rules-with-a-Zero-Hit-Count-MDS-or-SMS/m-p/40005

Re: Identify shadow rules

the_rock — Tue, 22 Nov 2022 17:31:03 GMT

I agree with the guys. I will tell you what I always do...is it best way to do this, probably not, but I find it useful. I simply export the rules in CSV format and then look for zero hits and also disabled rules.