Delete Unused Hosts, Networks, and Groups (R80.10 SMS & MDS)

[Adam_Forester]

V2 **Updated to support object databases of any size**

V3 **Added Separate scripts for MDS Support** 

V4 **Combined MDS and SMS into a single script. Export now creates a single file instead of two. **

NOTE: The larger the object database the more time this takes to run.

This is a simple shell script that will allow you to parse a particular object database for unused objects. The results will be output into three files of mgmt_cli commands to delete those objects (Host, Network, Group). You could use those files to automatically delete the objects but I suggest reviewing anything before you delete rules. Both SMS and MDS are supported in the same script.

You have two options of use; NAME or UID.

Please be careful when using any API tool to modify your database. Be sure to verify all data and have Backups

How to use

• cp script over to mgmt station (this script is intended to run directly on the mgmt station)
• execute ./script-name.sh
  • script will ask for IP of SMS or Domain of MDS you wish to search
• Output will be in delete-unused-objects.txt
  • delete-unused-objects.txt will have the mgmt_cli commands for deletion. If you want to execute it do the following;
    • chmod 755 delete-unused-objects.txt
    • ./delete-unused-objects.txt

Original files on github: GitHub - cpmidsouth/Delete-Unused-Objects: This Script will seach the object database for Unused Obj... 

Feedback welcome this was a simple project that came out of a client request.

[Gaurav_Pandya]

Hi Adam,

This is really nice script. I have run this in my LAB and tested.

Please let me know if we can do the same thing with Unused Rules. A script which shows names of Unused Rules.

[Adam_Forester]

Gaurav,

Thanks for the nice comment. I did a script a couple weeks ago that would search the rulebase for zero hit count. Take a look at it: https://community.checkpoint.com/docs/DOC-2640 

I'm working on v3 to be a bit more flexible with layers.

-Adam

[Chris_Wilson]

mgmt_cli and these scripts are for R80.x right?

[Gaurav_Pandya]

Hi Chris,

Yes. It is for R80.x

[Vanesa_Benito_O]

Great! This is exactly what i am looking for! I am migrating the configuration from an old firewall to check point and I always have hated insert unused objects in the new policy!!

I am going to test it!

Thank you

[Adam_Forester]

Awesome! Glad this will help, let me know if you have questions. After you get running and logs going for a few months take a look at https://community.checkpoint.com/docs/DOC-2640?sr=stream&ru=53216  and it will help you clean up your rulebase some

[S_E_]

Hi

Great tool!

Do you consider to expand the tool for Services (TCP|UDP|Groups)

Thanks

Regards