Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
AfterMath
Collaborator
Jump to solution

Firewall - Automating Firewall Rule Cleanup Based on Usage

Hi All

We’re starting a firewall rule review project across two clusters with over 1000 rules. (Identify, disabele, and after one week delete...)

We want to automatically identify: 

  • Rules that were created and have never been used

  • Rules that were created and with no traffic in over a year

  • Rules that previously had traffic but have been inactive for 12+ months

Is there a recommended way to extract this information accurately, we don want to do this manually! 

Thanks in advance!

2 Solutions

Accepted Solutions
Danny
Champion Champion
Champion

Check Point has a PolicyCleanUp tool for this task.
Personally I'd export the security policy to excel and just sort by first / last hit count to identify the rules in question.
Alternatively you could create your own bash / python script to automate the task regarding your specific demand.

View solution in original post

Tomer_Noy
Employee
Employee

Thanks for sharing this tool!

PolicyCleanUp is very useful, but it's worth mentioning that it only deals with cleaning up "un-hit" rules.

If you want to really tighten your policy, you might still have many rules that include un-hit objects or very wide networks or groups that only a small subset of them are in use.

Policy Insights (GA for a while now on R81.20 and above) will help you do a deep clean with prioritized recommendations for un-hit rules, un-hit objects and overly permissive groups / networks. It will even give some recommendations for group reuse to make your policy more readable.

Definitely worth trying it out.

View solution in original post

4 Replies
Chris_Atkinson
Employee Employee
Employee
0 Kudos
Danny
Champion Champion
Champion

Check Point has a PolicyCleanUp tool for this task.
Personally I'd export the security policy to excel and just sort by first / last hit count to identify the rules in question.
Alternatively you could create your own bash / python script to automate the task regarding your specific demand.

the_rock
Legend
Legend

Great advice Danny, was not aware of this tool.

Andy

0 Kudos
Tomer_Noy
Employee
Employee

Thanks for sharing this tool!

PolicyCleanUp is very useful, but it's worth mentioning that it only deals with cleaning up "un-hit" rules.

If you want to really tighten your policy, you might still have many rules that include un-hit objects or very wide networks or groups that only a small subset of them are in use.

Policy Insights (GA for a while now on R81.20 and above) will help you do a deep clean with prioritized recommendations for un-hit rules, un-hit objects and overly permissive groups / networks. It will even give some recommendations for group reuse to make your policy more readable.

Definitely worth trying it out.

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events