topic Firewall - Automating Firewall Rule Cleanup Based on Usage in General Topics

Firewall - Automating Firewall Rule Cleanup Based on Usage

AfterMath — Thu, 31 Jul 2025 09:46:49 GMT

Hi All

We’re starting a firewall rule review project across two clusters with over 1000 rules. (Identify, disabele, and after one week delete...)

We want to automatically identify:

Rules that were created and have never been used
Rules that were created and with no traffic in over a year
Rules that previously had traffic but have been inactive for 12+ months

Is there a recommended way to extract this information accurately, we don want to do this manually!

Thanks in advance!

Re: Firewall - Automating Firewall Rule Cleanup Based on Usage

Chris_Atkinson — Thu, 31 Jul 2025 13:03:23 GMT

Have you explored API options and Policy Insights?

https://community.checkpoint.com/t5/API-CLI-Discussion/Retrieving-Rule-Hit-Count-and-Unused-Rules-Information-via-API/td-p/191561

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuide/Content/Topics-SECMG/Policy_Insights.htm

Re: Firewall - Automating Firewall Rule Cleanup Based on Usage

Danny — Thu, 31 Jul 2025 13:13:28 GMT

Check Point has a PolicyCleanUp tool for this task.
Personally I'd export the security policy to excel and just sort by first / last hit count to identify the rules in question.
Alternatively you could create your own bash / python script to automate the task regarding your specific demand.

Re: Firewall - Automating Firewall Rule Cleanup Based on Usage

the_rock — Thu, 31 Jul 2025 13:29:39 GMT

Great advice Danny, was not aware of this tool.

Andy

Re: Firewall - Automating Firewall Rule Cleanup Based on Usage

Tomer_Noy — Tue, 19 Aug 2025 07:47:20 GMT

Thanks for sharing this tool!

PolicyCleanUp is very useful, but it's worth mentioning that it only deals with cleaning up "un-hit" rules.

If you want to really tighten your policy, you might still have many rules that include un-hit objects or very wide networks or groups that only a small subset of them are in use.

Policy Insights (GA for a while now on R81.20 and above) will help you do a deep clean with prioritized recommendations for un-hit rules, un-hit objects and overly permissive groups / networks. It will even give some recommendations for group reuse to make your policy more readable.

Definitely worth trying it out.