Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Noz
Employee Alumnus
Employee Alumnus

Find/Remove unused NAT rules

Hi, all.

I'm working on a method of identifying unused NAT rules and eliminating them. FW rules are easy enough because the have hit counters. NAT rules currently do not.

I know hit count for NAT rules is supported in R81, but the customer is looking for a workaround in current architecture (R80.40).

I can imagine that it may be possible to use API calls to dump both rulebases and compare the objects in each to find which are mutually exclusive. Then we would understand which objects are used in the NAT rulebase and not in the FW rulebase.

Has anybody successfully achieved the above scenario? If so, could you share your methodology with me?

Thanks,

Noah G

0 Kudos
2 Replies
PhoneBoy
Admin
Admin

You also have to keep in mind that NAT rules may be created as a result of object definitions.
Making actually getting all the NAT rules a little more complicated than analyzing an Access Policy.

0 Kudos
Noz
Employee Alumnus
Employee Alumnus

It's probably a more delicate process than I let on but I was hoping for advice on scoping out a method and potential limitations. I'm sure somebody's had a similar idea.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events