How to view rule usage for policy rules pushed to a device
group from Panorama.
As your policies change, tracking rule usage
on Panorama® helps you evaluate whether your policy implementation
continues to match your enforcement needs. This visibility helps
you identify and remove unused rules to reduce security risks and
keep your policy rule base organized. Additionally, rule usage tracking allows
you to quickly validate new rule additions and rule changes and
to monitor rule usage for operations and troubleshooting tasks.
On Panorama, you can view the rule usage of firewalls in a device
group—to which you pushed policies—to determine if all, some, or
none of the firewalls have traffic matches instead of being able
to monitor only the total number of hits across all firewalls in
a device group. You can quickly filter rules using the rule usage
data, such as Created and Modified dates, within a customizable
time frame. The displayed rule usage information persists across
reboot, data plane restarts, and upgrades.
On Panorama, you can view the rule usage details for managed firewalls that are running a PAN-OS
10.2 or later release, that have policy rule hit count enabled (default), and for
which you have defined and pushed policy rules using device groups. Panorama cannot
retrieve rule usage details for policy rules configured locally on the firewall so
you must log in to the firewall to view rule usage information for locally
configured rules.
High Availability Synchronization and Timestamp Behavior
When you add a secondary Panorama appliance to an existing environment to create an
HA pair, both devices synchronize their configurations. The passive device resets
rule creation and modification timestamps to the exact date and time the
synchronization occurred, rather than retaining the original dates from the active
device.
For example, if you created a security rule three years ago on the active Panorama,
the passive device incorrectly displays the creation date as the day the device
joined the cluster and not to the original dates on the active device. If you run
auditing scripts against the passive Panorama to identify old or stagnant rules,
Panorama yields misleading results. To avoid this, always direct your API queries
and auditing scripts to the active Panorama device, which retains the authoritative
rule creation and modification dates.
Retrieve Rule Usage Data Using the CLI
For large rulesets, retrieve the data using the command-line interface (CLI) to
bypass API query limits. SSH into Panorama and run:
> show rule-hit-count device-group <DGNAME> pre-rulebase security rules all
> show rule-hit-count device-group <DGNAME> post-rulebase security rules all
Save this output to a text file and use a script, such as Python with Regex, to parse
the hit counts.
After filtering your policy rulebase, administrators
can take action to delete, disable, enable, and tag policy rules
directly from the policy optimizer. For example, you can filter
for unused rules and then tag them for review to determine whether
they can be safely deleted or kept in the rulebase. By enabling
administrators to take action directly from the policy optimizer,
you reduce the management overhead required to further assist in
simplifying your rule lifecycle management and ensure that your
firewalls are not over-provisioned.
Policy rule usage
data may also be useful when using
Policy Optimizer to prioritize
which rules to migrate or clean up first.
Policy rule usage data is not preserved when you
transition to a different Panorama model.
This means that all existing policy rule usage data from the old Panorama is no
longer displayed after a successful migration to a new Panorama model. After a
successful migration, Panorama begins tracking policy rule usage data based on
the date the migration was completed. For example, the
Created date displays the date the migration
was completed.
To view the
rule usage across any Shared rule or for a specific device group:
Log in to the Panorama web interface.
Verify that the
Policy Rule Hit Count is
enabled.
Navigate to Policy Rulebase Settings (.
Verify that
Policy Rule Hit Count is
enabled.
Select to
view a rule.
Change the Device Group context to
Shared or
to the specific device group you want to view.
Determine whether the rule is being used (Rule Usage).
The policy rule usage status is one of the following:
Firewalls must run PAN-OS 8.1 or later release with Policy
Rule Hit Count enabled for Panorama to determine rule usage.
Used—When all firewalls in the device group—to which
you pushed the policy rule—have traffic matches for the policy rule.
Partially Used—When some of the firewalls in the device
group—to which you pushed the policy rule—have traffic matches for
the policy rule.
Unused—When no firewalls in the device group—to which
you pushed the policy rule—have traffic matches for the policy rule.
Em-dash (—)—When no firewalls in the device group—to
which you pushed the policy rule—have Policy Rule Hit Count enabled
or available for Panorama to determine the rule usage.
Modified—The date and time the policy rule was last
modified.
Created—The date and time the policy rule was created.
If
the rule was created when Panorama was running PAN-OS 8.1 and the
Policy Rule Hit Count setting is enabled, the First Hit date and
time is used as the Created date and time on upgrade to PAN-OS 9.0
or later releases. If the rule was created in PAN-OS 8.1 when the
Policy Rule Hit Count setting was disabled or if the rule was created
when Panorama was running PAN-OS 8.0 or an earlier release, the
Created date for the rule will be the date and time you successfully upgraded
Panorama to PAN-OS 9.0 or later releases.
In a Panorama HA
deployment, this date reflects the initial HA synchronization date
on the passive device, not the original rule creation date. Always
query the active Panorama appliance for accurate, original rule
timestamps.
Click the Rule Usage status to view the list of firewalls
using the rule and the hit-count data for traffic that matches that
rule on each firewall.
(
Optional) View the policy rule hit-count data
for individual firewalls in the device group.
Click
Preview Rules.
From the Device context, select the firewall for which
you want to view the policy rule usage data.
Select
Policies and, in the Policy
Optimizer dialog, view the
Rule Usage filter.
Filter rules in the selected rulebase.
You can filter the rule usage for rules pushed to firewalls
from Panorama. Panorama cannot filter rule usage for rules configured
locally on the firewall.
Use the rule
usage filter to evaluate the rule usage within a specified period
of time. For example, filter the selected rulebase for Unused rules
within the last 30 days. You can also evaluate rule usage with other
rule attributes, such as the Created and Modified dates, which enables
you to filter for the correct set of rules to review. You can use
this data to help manage your rule lifecycle and to determine if
a rule needs to be removed to reduce your network attack surface.
Select the
Timeframe you
want to filter on, or specify a
Custom time
frame.
Select the rule
Usage on which
you want to filter.
(
Optional) If you have reset the rule usage
data for any rules, check for
Exclude rules reset during
the last <number of days> days and
decide when to exclude a rule based on the number of days you specify since
the rule was reset. Only rules that were reset before your specified
number of days are included in the filtered results.
(
Optional) Specify search filters based on
additional rule data, other than the rule usage.
Hover your mouse over the column header, and from
the drop-down select Columns.
Add any additional columns you want to filter with or to
display.
Hover your mouse over the column data that you would like
to filter, and select Filter from the drop-down.
For data that contain dates, select whether to filter using This
date, This date or earlier, or This
date or later.
-
Take action on one or more unused policy rules.
Select one or more unused policy rules.
Perform one of the following actions:
Delete—Delete one or more
selected policy rules.
Enable—Enable one or more selected
policy rules when disabled.
Disable—Disable one or more selected
policy rules.
Tag—Apply one or more group tags to
one or more selected policy rules. The group tag must already exist
in order to tag policy rule.
Untag—Remove one or more group tags
from one or more selected policy rules.
Select Commit and Commit
and Push your changes.
