Question about optimizing policies

[RemoteUser]

Hi Mates,
What is the best way to optimize security policies, especially in a datacenter environment? (Large policy-package)
Are there any best practices that should be followed?
If I have a rule with “Any” as the protocol, what is the best way to analyze and optimize it?
Are there any tools integrated with Check Point that can help?

Thanks 

[Vincent_Bacher · Accepted solution]

Some thoughts knowing that in huge policy packages it could be extremely hard work:

General / Structure

• Move most-used rules (high hit count) to the top
• Place specific rules before general ones
• Broad rules (Any / large networks) towards the bottom
• Use clear sections / inline layers for readability

Analysis & Maintenance

• Zero-hit rules:
  
• verify (shadowed vs. obsolete)
• remove or disable
• Merge duplicate or overlapping rules
• Maintain comments (rule purpose / business context)

Performance & Logging

• High-hit allow rules: consider Track = None if logging not absolutely necessary 
• Log selectively, not everywhere

Tips to get rid of “Any” rules

• Temporarily enable logging on the Any rule
• Analyze in SmartLog / SmartEvent:
  
• which ports
• which applications
• Split the rule:
  
• explicit services (e.g. TCP 443, 22)
• or Application Control instead of ports
• Use Policy Optimizer for automatic suggestions (Tufin, AlgoSec or similar)
• Monitor after changes, then remove the Any rule

[PhoneBoy · Accepted solution]

We have something called Policy Insights that can help with this.
It is a paid feature available in our AI Management bundles (appropriate SKUs are here https://www.checkpoint.com/resources/items/solution-brief-ai-powered-security-management-for-the-hyp... ).

[the_rock · Accepted solution]

Personally bro, but this is just me, I always create inline layers where needed and use ordered layers as well. Make sure to disable any unused rules (or delete them if 100% sure no hits). Hope my post below helps.

https://community.checkpoint.com/t5/General-Topics/Lab-setup-video/m-p/268062

Happy to show you all this in smart console as well, though video explains it pretty well (I would say). I also attached simple word doc about it as well.