Firewall - Automating Firewall Rule Cleanup Based on Usage

[AfterMath]

Hi All

We’re starting a firewall rule review project across two clusters with over 1000 rules. (Identify, disabele, and after one week delete...)

We want to automatically identify: 

• Rules that were created and have never been used

• Rules that were created and with no traffic in over a year

• Rules that previously had traffic but have been inactive for 12+ months

Is there a recommended way to extract this information accurately, we don want to do this manually! 

Thanks in advance!

[Chris_Atkinson]

Have you explored API options and Policy Insights?

https://community.checkpoint.com/t5/API-CLI-Discussion/Retrieving-Rule-Hit-Count-and-Unused-Rules-In...

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuid...

[Danny · Accepted solution]

Check Point has a PolicyCleanUp tool for this task.
Personally I'd export the security policy to excel and just sort by first / last hit count to identify the rules in question.
Alternatively you could create your own bash / python script to automate the task regarding your specific demand.

[the_rock]

Great advice Danny, was not aware of this tool.

Andy

[Tomer_Noy · Accepted solution]

Thanks for sharing this tool!

PolicyCleanUp is very useful, but it's worth mentioning that it only deals with cleaning up "un-hit" rules.

If you want to really tighten your policy, you might still have many rules that include un-hit objects or very wide networks or groups that only a small subset of them are in use.

Policy Insights (GA for a while now on R81.20 and above) will help you do a deep clean with prioritized recommendations for un-hit rules, un-hit objects and overly permissive groups / networks. It will even give some recommendations for group reuse to make your policy more readable.

Definitely worth trying it out.