Policy Analyzer and Optimizer

Security Cloud Control provides the Policy Analyzer and Optimizer, which is an intelligent cloud service that can analyze security policies, detect anomalies, and provide recommendations on remediations that can be performed to optimize the policies.

About Policy Analyzer and Optimizer

AIOps for firewalls leverages artificial intelligence (AI) and machine learning (ML) to streamline and enhance the management and security of network firewalls. By using dynamic baselines and advanced forecasting models, AIOps can detect policy anomalies and predict potential issues before they escalate, ensuring proactive maintenance and stability. One of the key functionalities of AIOps is the Policy Analyzer and Optimizer. See AIOps Insights to know more about the various other functionalities that AIOps provides.

Secure Firewall Threat Defense devices with extensive policies may have numerous duplicate or shadowed rules. Such bloated policies with unoptimized rulesets can lead to excessive consumption of device memory, delayed loading of rules, and long search duration, resulting in inefficient security policy enforcement, reduced network speeds, and extended deployment durations.

Policy Analyzer and Optimizer is an intelligent Security Cloud Control Firewall Management service that analyzes firewall policies, detects rule anomalies, and helps you understand where a policy can be optimized. Policy Analyzer and Optimizer support both access control policies and Network Address Translation (NAT) policies for Cloud-Delivered Firewall Management Center and supported Security Cloud Control-managed On-Premises Firewall Management Center data sources.

In addition, this feature can do the following:

  • View policy health and optimization opportunities for the selected management center data source.

  • Analyze policies on demand or rely on scheduled analysis that runs every 24 hours.

  • Download analysis reports as PDFs after analysis completes.

  • Use Access Control Policy Analyzer and Optimizer remediation workflows where supported.

  • Use Network Address Translation Policy Analyzer and Optimizer findings and AIOps insights to investigate NAT policies that contain optimizable rules.

Common Policy Analyzer and Optimizer concepts

Policy Analyzer and Optimizer uses these shared concepts across access control policy analysis .

Table 1.

Concept

Common behavior

Policy-type difference

Data source

A Cloud-Delivered Firewall Management Center or an On-Premises Firewall Management Center selected in Policy Analyzer and Optimizer.

The Access Control tab can be used for supported On-Premises Firewall Management Center data sources. The Network Address Translation tab is available only when Network Address Translation Policy Analyzer and Optimizer is enabled through AIOps for the selected data source.

Sync

Fetches current policy inventory and metadata, including newly created, deleted, or modified policies.

Sync does not, by itself, create a new analysis summary. If the policy changed after the last analysis, run analysis again or wait for scheduled analysis.

Analysis

Evaluates selected policies and produces policy health information, observations, and report data.

Access control Policy Analyzer and Optimizer evaluates access control rule and object findings. Network Address Translation Policy Analyzer and Optimizer evaluates NAT rule shadowing and redundancy.

Reporting

Provides a downloadable analysis report after analysis completes.

Access control Policy Analyzer and Optimizer also provides remediation reports after supported remediation is applied.

Remediation

A workflow that stages selected changes and applies them only when you select Apply Remediation.

Available for access control policies. Network Address Translation Policy Analyzer and Optimizer does not provide an Apply Remediation workflow.

Prerequisites to use Policy Analyzer and Optimizer

Before you use Policy Analyzer and Optimizer, verify the prerequisites that apply to your policy type and data source.

  • The On-Premises Firewall Management Center must be integrated with Security Cloud Control.


    Note

    For On-Premises Firewall Management Center Versions from 7.2 to 7.6, the integration is referred to as SecureX integration.

  • The Cloud-Delivered Firewall Management Center must be provisioned in Security Cloud Control Firewall Management.

Prerequisites to use Policy Analyzer and Optimizer for access control policy

  • Access control policy analysis is supported on the On-Premises Firewall Management Center operating on Version 7.2 or later. The Cisco-suggested Version is 7.6 or later, because these versions support cross-launch to Policy Analyzer and Optimizer directly from On-Premises Firewall Management Center.

  • Access control policy to be analyzed must be associated with a Firewall Threat Defense device that is managed by an On-Premises Firewall Management Center integrated with Security Cloud Control.

Enable Policy Analyzer and Optimizer for Security Cloud Control-managed On-Premises Firewall Management Center

Onboard your On-Premises Firewall Management Center to Security Cloud Control, navigate to Administration > Integrations > Firewall Management Center, select the on-premises Firewall Management Center, and choose Policy Analyzer and Optimizer under System in the right pane. See Onboard an On-Premises Firewall Management Center for more information.

If you have an On-Premises Firewall Management Center Version 7.6 and want to use Policy Analyzer and Optimizer, follow the steps below:

Procedure

Step 1

In your On-Premises Firewall Management Center, navigate Integration > Security Cloud Control.

Step 2

If you have not integrated your On-Premises Firewall Management Center with Cisco Security Cloud, click Enable Security Cloud Control and follow the steps. To authorize the cloud integration, you must choose an existing Security Cloud Control tenant or provision a new one, to which your on-premises Firewall Management Center will get onboarded, after the cloud integration is successful.

Step 3

After integrating your On-Premises Firewall Management Center with Security Cloud Control, check the Enable Policy Analyzer and Optimizer checkbox and click Save.

Step 4

Go to Policies > Access Control.

Step 5

Select a policy and click Analyze Policy. Note that the Anomaly column displays In Progress and once the analysis is complete, it displays the number of anomalies and the percentage of the policy optimizable.

Step 6

Click on the percentage to be cross-launched to the Policy Analyzer and Optimizer page in the Security Cloud Control tenant to which your On-Premises Firewall Management Center is registered.

Policy Analyzer and Optimizer Licensing Requirements

The Policy Analyzer and Optimizer does not require any additional licensing. It comes as part of the Security Cloud Control base subscription.

Open Policy Analyzer and Optimizer and select a data source

You can open Policy Analyzer and Optimizer from Security Cloud Control Firewall Management or cross-launch from supported On-Premises Firewall Management Center policy pages.

Follow these steps to open Policy Analyzer and Optimizer and select a data source:

Procedure

Step 1

In the Security Cloud Control Firewall Management left pane, choose Administration > Integrations > Firewall Management Center.

Step 2

Select Cloud-Delivered FMC or an On-Premises Firewall Management Center.

Step 3

Click Policy Analyzer and Optimizer under System.

Note

 

Alternatively, choose Insights & Reports > AIOps Insights > Policy Analyzer and Optimizer.

Step 4

Use the data source selector at the top of the Policy Analyzer and Optimizer page to choose the Cloud-Delivered Firewall Management Center or On-Premises Firewall Management Center whose policies you want to review.

Step 5

Choose the Access Control tab or the Network address translation tab, depending on the policy type that you want to analyze.

Note

 

If the selected data source is not enabled for AIOps, the Network address translation tab displays a message explaining that NAT Policy Analyzer and Optimizer requires AIOps for the selected data source. You can still use access control Policy Analyzer and Optimizer if the access control prerequisites are met.

If the selected data source is not enabled for AIOps, the Network address translation tab will show a message indicating that the NAT Policy Analyzer and Optimizer require AIOps for the selected data source. However, you can still utilize the access control Policy Analyzer and Optimizer if the access control prerequisites are met.

Understand sync, last modified, and last analyzed

Policy Analyzer and Optimizer displays policy metadata such as analysis status, last modified time, and last analyzed time. The last modified time reflects changes made to the policy in the managing the management center. The last analyzed time reflects the analysis run that produced the current Policy Analyzer and Optimizer summary.

Use Sync with FMC the latest policy inventory and modified timestamps from the management center. If a policy was modified after the last analysis, the displayed analysis can be out of date until you run analysis again or scheduled analysis runs.

Access control policy Policy Analyzer and Optimizer

Use the Access Control tab when you want to analyze access control policies, review access control policy findings, and apply the remediations that Policy Analyzer and Optimizer supports for access control rules and objects.

After provisioning a Cloud-Delivered Firewall Management Center or onboarding an On-Premises Firewall Management Center to your Security Cloud Control tenant, and creating policies, you can start analyzing them using the Policy Analyzer and Optimizer.

For more information, refer to Onboard an On-Premises Firewall Management Center and Enable Cloud-Delivered Firewall Management Center on Your Security Cloud Control.

Analyze access control policies on Cloud-Delivered Firewall Management Center

After provisioning a cloud-delivered Firewall Management Center or onboarding an on-premises Firewall Management Center to Security Cloud Control, follow these steps to analyze access control policies from PAO:


Note

When you create a new policy, it might take a while for the Policy Analyzer and Optimizer to fetch the policy details and show up on the Policy Analyzer and Optimizer. Click the refresh () button on the top-right corner to manually refresh the page to see new policies.

Procedure

Step 1

Choose Insights & Reports > AIOps Insights > Policy Analyzer and Optimizer.

Step 2

Choose Cloud-delivered FMC from the drop-down list as the data source.

Step 3

In the Access Control area, select the policy you want to analyze or review.

Note

 

  • For an unanalyzed policy, click on Analyze Policy.

  • If the policy status indicates Analysis out of date, click on Re-analyze Policy under Analysis Actions on the right.

Step 4

For analyzed policies, the Policy Analyzer and Optimizer provides an overview of the analysis that includes Total Rules, Observations, Anaysis Status, and Last Modified and Last Analyzed timestamps. You can also see more details on the right pane when you select a policy.

Analyze On-Premises Firewall Management Center Policies

To analyze policies on an on-premises Firewall Management Center version 7.2 or later using Policy Analyzer and Optimizer, you must first onboard it to Security Cloud Control. You can use either Auto discover from Cisco Security Cloud or Use Credentials for onboarding. If you are using version 7.6, integrate the device with Cisco Security Cloud, which then onboards your on-premises Firewall Management Center to your Security Cloud Control tenant.

Complete these prerequisites before you begin:

  • After onboarding your on-premises Firewall Management Center, ensure that its in Active status in Administration > Integrations > Firewall Management Center.

  • Check the Enable Policy Analysis & Optimization checkbox after you integrate with the Cisco Security cloud, by navigating to Integration > Cisco Security Cloud.

  • If you have just onboarded an on-premises Firewall Management Center or created or imported a new policy in an already onboarded on-premises Firewall Management Center, wait until the Policy Analyzer and Optimizer fetches the policies.

  • You can trigger policy analysis manually, or let the system automatically analyze policies as part of the scheduled automated analysis.

Procedure

Step 1

Choose Administration > Integrations > Firewall Management Center.

The Services page appears with Cloud-Delivered FMC selected by default.

Step 2

Select the on-premises Firewall Management Center whose policies you want to analyze.

Step 3

Click Policy Analyzer and Optimizer under System on the right pane.

Alternatively, choose Insights & Reports > AIOps Insights > Policy Analyzer and Optimizer on the left pane. The Showing policy for option at the top-left corner indicates which device's policies are displayed. Click this option to switch between Cloud-Delivered Firewall Management Center and other on-premises Firewall Management Centers.

Note

 

You can also trigger the analysis of a policy from the on-premises Firewall Management Center interface. For more information, see Enable Policy Analyzer and Optimizer for Security Cloud Control-managed On-Premises Firewall Management Center.

Step 4

For analyzed policies, the Policy Analyzer and Optimizer provides an overview of the analysis that includes Total Rules, Observations, Analysis Status, and Last Modified and Last Analyzed timestamps. You can also see more details in the right pane when you select a policy.

Policy Reporting

When your policies are analyzed and ready, on the Policy Analyzer and Optimizer page, the Analysis Status is Completed and the Observations column displays if your policy is healthy or can be optimized.

Select the policy to see details about the analysis on the right pane. You can View analysis details & optimize, Download Analysis Report, and view the Remediation History.

Policy analysis summary

The Summary tab includes the following rule information, presented in pie charts and bar graphs:

Overall summary—provides insights on how many rules are healthy, disabled, expired, and contain anomalies, using a pie chart. You can also hover over the part of the pie to view the percentage of rules.

Rule usage history—provides insights on the recentness on the rule usage, with time periods.

Rules with Anomalies—provides insights on how many rules have anomalies, using a bar graph. Hover over the bars to see the number of rules having anomalies.

Hits rules & dead rules—provides insights on hitcount of expired rules, for rule types including allow, block, monitor, and trust.

Duplicate Rules

The Duplicate Rules tab lists shadowed and redundant rules with anomalies:

  • A Fully Shadowed rules is one that will never evaluate network traffic because another rule that precedes it over shadows this rule.

  • A Fully Redundant rules is one that is just a part of another larger rule, such that removing this redundant rule does not have an impact on the network traffic, because the traffic evaluation that this rule must perform is already performed by another rule.


Note

Expand each observation to review the affected rules before you stage a remediation. Each rule in the list is displayed with a set of attributes; click the settings button on the top right to select which rule attributes you would like to see along with the rule.

After you stage the selected duplicate-rule remediations, you can still Undo them before clicking Apply Remediation. It is recommended that you disable rules first to measure the impact and delete them later, because deleting them permanently removes them.

You can enable the disabled rules any time by navigating to the Cloud-Delivered Firewall Management Center or the On-Premises Firewall Management Center on which the rules are present.

Expired Rules

The Expired Rules tab lists rules that were configured with a time range and the time range has expired. You can also see rule information such as the date on which the rule expired, hit count, last hit time, and the time range.

Mergeable Rules

The Mergeable Rules tab lists the rules that have similar allow and block settings and can be merged into a single rule.


Note

When you merge selected rules, the logging settings from the first rule are applied to the rule that the first rule is getting merged with. Therefore, the logging behavior for the merged rule follows the settings configured on the first rule, and any unique logging configurations from other rules are overwritten.

Overlapping Objects

The Overlapping Objects tab lists objects that are either fully overlapping (the IP addresses or port numbers are either the same or a complete subset) or partially overlapping (some subset of IP addresses are repeated, but not all).

For example, if a rule contains an object for 192.168.1.1 and another for 192.168.1.0/24, the 192.168.1.1 object is fully overlapped by the other object and is not needed in the rule.

For partial overlaps, you need to evaluate each occurrence, determine if any changes can be made, and implement those changes directly by editing the objects.

Policy insights

The Policy Insights tab has a Hit Count section that initially lists any rules that have never been triggered (Never Hit Rules). The hit count information is from all devices that are assigned to the policy. You can change criteria and see other hit count information, for example, Not Hit Rules for the past 6 months, or Hit Rules over a selected time period. You can filter the rules using the actions set in the rules, hit information, and time period:

  • Never Hit Rules—Rules that have never been hit from the time they were created.

  • Hit Rules—Rules that have been hit in the selected time period.

  • Not Hit Rules—Rules that have not been hit in the selected time period.

Select the rules you want to disable or delete and click Disable Rules or Delete Rules. It is recommended that you disable the rules first to measure the impact of disabling them and then delete them.

Policy Remediation

When you choose to delete or disable rules with anomalies from the analysis summary, the Policy Analyzer and Optimizer does not immediately apply those changes. The changes that you wanted to do are staged and are applied only when you click Apply Remediation.

Note that after clicking Apply Remediation once, you cannot apply remediations again based on the same report. You must run a policy analysis again on the new policy settings and remediate the anomalies using the new report.

Apply Policy Remediation

Before you begin

  • Ensure you take a backup of all the policies before applying remediations.

  • Ensure you have a few policy remediations that are staged to be applied. If there are no staged changes, the Apply Remediation button is disabled.

  • Ensure you have verified the Policy Last Modified, Policy Last Analysed dates and timestamps, and the number of rules that you have marked for remeditation, at the top-right corner, so that you are sure which version of the policy you are applying the remediations to.

Procedure

Step 1

In the Policy Analyzer and Optimizer page, select the policy to see details about the analysis on the right pane and click View analysis details & optimize.

Step 2

Click the remediation tab that contains the anomalies that you want to fix.

Step 3

Expand a category and select the check box next to the anomaly category to stage all observations in that category, or select the check box next to individual observations to stage only the remediations that you want to apply. Repeat this step in other remediation tabs, as needed.

Step 4

Select the appropriate action for the selected rules.

Step 5

Click Apply Remediation to commit the changes.

Step 6

Read through the confirmation pop-up, which contains a gist of all the remediations that will be applied, and ensure you are not applying remediations to policies that you do not want remediated.

Step 7

Click Apply.

After remediation is complete, the selected rules will be updated. The updated policies are automatically analyzed to generate a new summary and highlight any remaining issues.

Step 8

You can click Download Optimization Report.

The remediation report contains consolidated data of all the remediations applied and the rules they were applied to. When you select a policy from the Policy Analyzer and Optimizer page, you can view the Remediation History from the right pane, which includes data about the date and time of the remediation, the user who initiated the remediation, and the remediation status. You can also download the remediation report from the same pop-up.

All the remediations are recorded and are available under Remediation History, with information such as date and time of the remediation, the user who performed the remediation, and so on.

Note

 

For an On-Premises Firewall Management Center in which the Change Management Workflow is enabled, when policy remediations are applied, an internal workflow ticket is created and the changes are staged. The changes take effect only when the ticket is submitted or approved. See Change Management in Cisco Secure Firewall Management Center Administration Guide for more information.

What Does the Policy Remediation Report Contain?

The policy remediation report consolidates all the pieces of completed remediation and can be downloaded as a PDF. The report contains only the remediation sections that apply to the remediations that you selected and applied to your policies. Each section includes information about the rule name, the remediation action taken, and any related comments. For example, if you did not remediate any duplicate rules, the report does not contain the section for duplicate-rule remediation.

  • Remediation Summary

  • Hit Count Remediation

  • Expired Rules Remediation

  • Duplicate Rules Remediation

  • Mergeable Rules Remediation


Note

To know if a policy is remediated by the Policy Analyzer and Optimizer, navigate to Policies > Access Policies and edit a policy to view the rules in the Policy Editor. When a policy is remediated by Policy Analyzer and Optimizer, a comment gets added to the rules that are optimized. You can also filter all the rules optimized by the Policy Analyzer and Optimizer using "updated by Policy Analyzer and Optimizer" to view all the rules remediated by the Policy Analyzer and Optimizer.

Troubleshooting Policy Analyzer and Optimizer

Read the following sections to troubleshoot any issues with the Policy Analyzer and Optimizer:

Policy Analyzer and Optimizer Does Not Analyze Policies

If you notice that Policy Analyzer and Optimizer is not analyzing policies despite clicking Analyze Policy, try the following:

Procedure

Step 1

Navigate Administration > Integrations > Firewall Management Center.

Step 2

Select the On-Premises Firewall Management Center or Cloud-Delivered FMC for which the policy analysis is not happening and choose Workflows under Actions on the right pane.

Step 3

If you see that the latest workflow's Current State shows up as Error, expand the workflow and scroll to the last action whose END STATE is ERROR.

Step 4

Click Error Message under the RESULT column to see a detailed error message or click Stack Trace to see the series of exceptions that occurred, which caused the error.

Step 5

Resolve the error or contact Cisco TAC for assistance.

Policy Analyzer and Optimizer Does Not Fetch Policies

If policies on your On-Premises Firewall Management Center are not displayed on the Policy Analyzer and Optimizer page on Security Cloud Control, do the following:

Procedure

Step 1

On the On-Premises Firewall Management Center, navigate Integration > Cisco Security Cloud.

Step 2

Ensure that the Enable Policy Analyzer and Optimizer checkbox is checked.

Step 3

(Optional) In the left navigation pane of your Security Cloud Control tenant, navigate Administration > Integrations > Firewall Management Center, and ensure that the On-Premises Firewall Management Center is active and reachable.

Frequently Asked Questions About Policy Analyzer and Optimizer

Can Cisco AI Assistant analyze and remediate policies instead of manually doing it using Policy Analyzer and Optimizer?

The Cisco AI Assistant collaborates with Policy Analyzer and Optimizer to scrutinize policies with anomalies and notify users. However, the AI Assistant cannot automatically analyze and remediate policies.

Can Policy Analyzer and Optimizer detect new changes to an already-analyzed policy and run analysis again on the same policy?

No, the Policy Analyzer and Optimizer can analyze policies only when manually triggered or at a 24-hour scheduled policy analysis run.

For a shared policy, does the Policy Analyzer and Optimizer provide individual device-based reports?

No. The Policy Analyzer and Optimizer provides reports only based on the access policy analysis data.

I am an On-Premises Firewall Management Center user. Should I purchase the Security Cloud Control base license to use the Policy Analyzer and Optimizer?

No. The Policy Analyzer and Optimizer comes as part of an existing or a newly created Security Cloud Control tenant during the Cisco Security Cloud integration.

I provisioned a Security Cloud Control tenant when I integrated my On-Premises Firewall Management Center with the Cisco Security Cloud. What other features, except Policy Analyzer and Optimizer, can I leverage in Security Cloud Control?

You can only leverage Policy Analyzer and Optimizer capabilities of this Security Cloud Control tenant. To use other features of Security Cloud Control, you need to purchase the Security Cloud Control base license and other device-specific licenses.

For an On-Premises Firewall Management Center on which the change management workflow is enabled and there are policies with pending changes to be approved, can the Policy Analyzer and Optimizer still apply remediations those policies?

No. The remediation will be hindered with an error saying the policies are locked for use.

Is there a maximum number of rules that Policy Analyzer and Optimizer can analyze in a policy?

There are no such limits. The Policy Analyzer and Optimizer can analyze any number of policies and rules. However, when the policies have more number of rules, the analysis takes a long time too.

What is the difference between disable rules and delete rules? Which is the better option?

Deleting a rule removes the rule completely from the device memory. However, disabling a rule keeps it in the device memory as a backup and does not get deployed to the device.

If a policy remediation fails when it is partially done, are the changes automatically revoked by Policy Analyzer and Optimizer?

No. In such a case, you get a failure notification and a remediation report. You can read the report to know which rules were impacted by the half-done remediation, manually revoke the changes, and start the remediation all over again.