topic Delete Unused Hosts, Networks, and Groups (R80.10 SMS & MDS) in API / CLI Discussion

Delete Unused Hosts, Networks, and Groups (R80.10 SMS & MDS)

Adam_Forester — Sat, 03 Mar 2018 20:44:30 GMT

V2 **Updated to support object databases of any size**

V3 **Added Separate scripts for MDS Support**

V4 **Combined MDS and SMS into a single script. Export now creates a single file instead of two. **

NOTE: The larger the object database the more time this takes to run.

This is a simple shell script that will allow you to parse a particular object database for unused objects. The results will be output into three files of mgmt_cli commands to delete those objects (Host, Network, Group). You could use those files to automatically delete the objects but I suggest reviewing anything before you delete rules. Both SMS and MDS are supported in the same script.

You have two options of use; NAME or UID.

Please be careful when using any API tool to modify your database. Be sure to verify all data and have Backups

How to use

cp script over to mgmt station (this script is intended to run directly on the mgmt station)
execute ./script-name.sh
- script will ask for IP of SMS or Domain of MDS you wish to search
Output will be in delete-unused-objects.txt
- delete-unused-objects.txt will have the mgmt_cli commands for deletion. If you want to execute it do the following;
  - chmod 755 delete-unused-objects.txt
  - ./delete-unused-objects.txt

Original files on github: GitHub - cpmidsouth/Delete-Unused-Objects: This Script will seach the object database for Unused Objects and output a de…

Feedback welcome this was a simple project that came out of a client request.

Re: Delete Unused Hosts, Networks, and Groups (R80.10 SMS & MDS)

Gaurav_Pandya — Mon, 05 Mar 2018 17:48:08 GMT

Hi Adam,

This is really nice script. I have run this in my LAB and tested.

Please let me know if we can do the same thing with Unused Rules. A script which shows names of Unused Rules.

Re: Delete Unused Hosts, Networks, and Groups (R80.10 SMS & MDS)

Adam_Forester — Fri, 21 Jun 2019 09:24:17 GMT

Gaurav,

Thanks for the nice comment. I did a script a couple weeks ago that would search the rulebase for zero hit count. Take a look at it: https://community.checkpoint.com/docs/DOC-2640

I'm working on v3 to be a bit more flexible with layers.

-Adam

Re: Delete Unused Hosts, Networks, and Groups (R80.10 SMS & MDS)

Chris_Wilson — Fri, 27 Apr 2018 17:03:02 GMT

mgmt_cli and these scripts are for R80.x right?

Re: Delete Unused Hosts, Networks, and Groups (R80.10 SMS & MDS)

Gaurav_Pandya — Fri, 27 Apr 2018 17:58:45 GMT

Hi Chris,

Yes. It is for R80.x

Re: Delete Unused Hosts, Networks, and Groups (R80.10 SMS & MDS)

Vanesa_Benito_O — Fri, 18 May 2018 18:34:42 GMT

Great! This is exactly what i am looking for! I am migrating the configuration from an old firewall to check point and I always have hated insert unused objects in the new policy!!

I am going to test it!

Thank you

Re: Delete Unused Hosts, Networks, and Groups (R80.10 SMS & MDS)

Adam_Forester — Fri, 21 Jun 2019 09:24:20 GMT

Awesome! Glad this will help, let me know if you have questions. After you get running and logs going for a few months take a look at https://community.checkpoint.com/docs/DOC-2640?sr=stream&ru=53216 and it will help you clean up your rulebase some

Re: Delete Unused Hosts, Networks, and Groups (R80.10 SMS & MDS)

S_E_ — Thu, 23 Sep 2021 13:15:34 GMT

Great tool!

Do you consider to expand the tool for Services (TCP|UDP|Groups)

Thanks

Regards