Hello Danny; thanks for the reply.
Yes, I have looked at Security Compliance. I'm just glad I don't have to use it, at least, not yet. Not that it's a bad tool, just looks like a ton of work.
I did learn several new things here that I was not aware of, but will come in handy: specifically, the unused objects and packet search mode.
But, to the gist of the matter, the policy rule optimization: yes, I was aware I could do it manually using these tools. So, checkpoint has nothing similar to the new Palo tool? Any plans in that direction?
I'm just looking at what it would take to put a checkpoint firewall in an east-west position in my network when I do not have all the info on what each application requires. Yes, I know it's possible to use a tap/span and a checkpoint in monitor mode or to put checkpoint in place with a wide open policy and manually harvest the data to narrow the policy. All those are a lot of work compared to what the Palo tool looks to offer.