topic Re: Report for unused objects on R77.30 SMS in General Topics

Report for unused objects on R77.30 SMS

Nelson_Thoms — Fri, 29 Dec 2017 01:45:46 GMT

Hello,

I am in the process of auditing the objects on an R77.30 mgmt. server and while I've found dbedit to be the best way to export the full object list, I am unable to determine if objects are used or not. I realise in Dashboard we can filter on unused objects however since we have hundreds of results, and I cannot just delete stuff without proper change process, I am not able to use the GUI for the required task (unless I just took a bunch of printscreens or manually retyped every object so I have it in a more usable form).

Is there a way to export the list of unused objects? either from Dashboard or perhaps using a command line tool?

Thank you for the assistance.

Nelson Thoms

Re: Report for unused objects on R77.30 SMS

XavierBens — Fri, 29 Dec 2017 13:56:37 GMT

A quick answer would be to use

whereused <table_name> <object_name>

instruction on to look for any of your exported list of object but... that could take a long time.

You could script something in the Web Visualization Tool xml or html export file too.

I assume we will wait together for better answers

Did you already used hit-count in order to look at rules which are no more used since 't' time (... and if a rule is no more used... you'll be able to delete it and maybe to have new 'unused' objects).

If you're interested, I've published a comment in which I'm starting to explain how to do.

Re: Report for unused objects on R77.30 SMS

Nelson_Thoms — Fri, 29 Dec 2017 20:38:49 GMT

Thanks Xavier, very helpful information there, and I have had a look at your link on unused rules which is certainly an area we will be addressing in our audit.

In terms of the Web Visualisation Tool - This looks exactly like what I need, not sure how I did not come across this in my searching and even a contact with checkpoint support! Thank you for providing this info

For now I will give the whereused command a go in dbedit, and I should be able to verify my results with the query done in Dashboard.

Cheers Xavier, really appreciate your feedback

Re: Report for unused objects on R77.30 SMS

Nelson_Thoms — Thu, 18 Jan 2018 21:20:24 GMT

The Web Visualisation Tool definitely helped me here - with a full export to XML of all objects and the firewall/NAT policies I am able to achieve the requirements! Thank you for this solution

Re: Report for unused objects on R77.30 SMS

Tomer_Sole — Mon, 22 Jan 2018 08:13:55 GMT

This is also available with the Compliance Blade.