topic Re: Disable/Delete Rules with a Zero Hit Count (MDS or SMS) in API / CLI Discussion

Disable/Delete Rules with a Zero Hit Count (MDS or SMS)

Adam_Forester — Sat, 17 Feb 2018 16:48:06 GMT

**v3 and above now allows you to pick a specific access layer**

**v4 added new functions thanks to user feedback. Now has the ability to navigate around section title headers and to handle of any size**

**v5 with a lot of work by Vincent Bacher‌ he determined that some larger policies need a time specified to search. This version added in a 6 month limit on hits prior to the day you run it (Today - 6Months.)**

** v6 combined MDS & SMS into a single script. Added the ability to disable or delete rules based on UID or NAME. The disable script will add a commend 'Disabled by Zero Hits'

This is a simple shell script that will allow you to parse a specific rulebase for rules with a ZERO hit count. The results will be output into a single file of mgmt_cli commands to disable or delete those rules.

The script is setup to run on the Mgmt station itself and uses the 'mgmt_cli -r true' function and uses the -d DOMAIN flag to support SMS and MDS in a single script

It is highly recommended to run the 'DISABLE' version prior to running a 'DELETE' it will treat it as a staging for full deletion

How to Use

Move script to the management station
./cleanup-zero-hits.sh
Enter IP address of SMS or CMA you wish to check
Follow remaining prompts for options
- uid or name
  - The script will ask if you want to export with uid or name. UID is more accurate as it does not change with position. This will prevent a situation where another admin is adding/removing rules from the rulebase before you are able to run the output file.

You can take the delete/disable command file and run it.

chmod 755 Output-Filename.txt
./Output-Filename.txt

Original files on github: GitHub - cpmidsouth/Delete-or-Disable-Zero-Hit-Rules: This script is designed to search a specifed rule base with ZERO h…

NOTE: If you use inline layers within the rulebase you will need to search those as a separate layer. This script is not effective in a rulebase where multiple targets within the same rulebase. I am working on that one. Thanks to Vincent Bacher‌ for being my QA and spending way too much time testing with me.

Feedback welcome this was a simple project that came out of a client request.

Re: Disable/Delete Rules with a Zero Hit Count (MDS or SMS)

Tomer_Sole — Sun, 18 Feb 2018 06:31:39 GMT

Very nice, and from field knowledge I know it's useful

And I like how outside of input/output text it's essentially one line of code. So that's kind of pretty on the inside

Few comments in case you are interested..

- The fact that you added "[PolicyName] + Network" means it will only work for Firewall-only users who upgraded their policies. With R80.10, users can create multiple layers in the policy, and then the names of those layers are determined by the users' choice. Also, users with FW+APPI who upgrade their policies will have a policy with 2 ordered layer: "[PolicyName] Network" and "[PolicyName] Applications" (and they can rename those layers as they wish)

- Deleting rules based on their number can be problematic in case someone has just published new rules above them. I'm not sure how common this scenario, but when we designed R80 we had multiple users in mind. So taking the "uid" of the rule rather than "rule-number" is safer.

Re: Disable/Delete Rules with a Zero Hit Count (MDS or SMS)

Adam_Forester — Sun, 18 Feb 2018 14:52:31 GMT

Tomer thanks for the input. I did write it specifically for an account that had upgraded, I didn't take into account the creation of policies in 80.10. I will work on that specific for the next version.

Agree on the safeness of UID, I chose rule number as a way for the customer to manually review before letting the API do the deleting, call it controlled paranoia. But I did tweak a couple things this morning to use UID tested it and it works just fine, I think I will upload that as a second option.

mgmt_cli -r true show access-rulebase name "$POL_NAME Network" details-level "standard" use-object-dictionary true show-hits true --format json | jq --raw-output --arg RBN "$POL_NAME" '.rulebase[] | select(.hits.value == 0) | ("mgmt_cli -r true delete access-rule uid " + (.uid|tostring) + " layer")' > $POL_NAME-tmp.txt; sed "s,$, '$POL_NAME Network'," $POL_NAME-tmp.txt > $POL_NAME-delete-unused-uid.txt; rm *tmp.txt

Re: Disable/Delete Rules with a Zero Hit Count (MDS or SMS)

Tomer_Sole — Sun, 18 Feb 2018 15:17:52 GMT

Awesome. Also I'm glad that you managed to workaround a customer's request by yourself. Imagine what you had to do if we didn't have this

Re: Disable/Delete Rules with a Zero Hit Count (MDS or SMS)

Adam_Forester — Fri, 23 Mar 2018 13:59:32 GMT

Tomer, I've now updated it to list out the Access Layers and allow the users to pick instead of just assuming the addition of Network. This should allow it to work for all packages upgraded or not.

Re: Disable/Delete Rules with a Zero Hit Count (MDS or SMS)

Jill_Sanders — Sun, 25 Mar 2018 10:21:39 GMT

Great job!

Re: Disable/Delete Rules with a Zero Hit Count (MDS or SMS)

Vincent_Bacher — Mon, 28 May 2018 06:56:13 GMT

Hi Adam,

nice useful script, good job.

One question:

I have just tested the script but unfortunately get no result, that means the utput file is empty.

Started the script:

./delete-zero-hits-rulenumber-v3.sh
This script will search a specific policy package for rules with a ZERO hit count.
Use with caution for deleting rules..
If for any reason you make a typo and need to exit use CTRL+C.
Press ENTER to continue
Listing Access Policy Package Names.
Applications
************-FW-POLICY Network
What is the Policy Package Name?

I tried the policy Name with or without "Network"

************-FW-POLICY Network

************-FW-POLICY

With or without quotation marks. Output file is always empty. Hopefully i find some time to have a look into the script and at the mgmt_cli commands.
Cheers

Vincent

Re: Disable/Delete Rules with a Zero Hit Count (MDS or SMS)

Adam_Forester — Mon, 28 May 2018 17:24:47 GMT

Interesting Vincent. Is it possible you don't have rules with a zero hit count? This is tested on 80.10.

I'm going to have you run the raw command to look for the output;

mgmt_cli -r true show access-rulebase name "************-FW-POLICY Network" details-level "standard" use-object-dictionary true show-hits true --format json | jq --raw-output '.rulebase[] | select(.hits.value == 0)'

See what that outputs. If it's nothing then run this;

mgmt_cli -r true show access-rulebase name "************-FW-POLICY Network" details-level "standard" use-object-dictionary true show-hits true --format json | jq --raw-output '.rulebase[]'

Then look for the output of each rule and the hits value; which should look like the below (I formatted the text you would look for)

"rule-number": 1,

"track": {

"type": "598ead32-aa42-4615-90ed-f51a5928d41d",

"per-session": false,

"per-connection": true,

"accounting": false,

"alert": "none"

"source": [