Find/Remove unused NAT rules

[Noz]

Hi, all.

I'm working on a method of identifying unused NAT rules and eliminating them. FW rules are easy enough because the have hit counters. NAT rules currently do not.

I know hit count for NAT rules is supported in R81, but the customer is looking for a workaround in current architecture (R80.40).

I can imagine that it may be possible to use API calls to dump both rulebases and compare the objects in each to find which are mutually exclusive. Then we would understand which objects are used in the NAT rulebase and not in the FW rulebase.

Has anybody successfully achieved the above scenario? If so, could you share your methodology with me?

Thanks,

Noah G

[PhoneBoy]

You also have to keep in mind that NAT rules may be created as a result of object definitions.
Making actually getting all the NAT rules a little more complicated than analyzing an Access Policy.

[Noz]

It's probably a more delicate process than I let on but I was hoping for advice on scoping out a method and potential limitations. I'm sure somebody's had a similar idea.