Access control policy analysis and optimization

Prerequisites

After provisioning a Cloud-Delivered Firewall Management Center or onboarding an On-Premises Firewall Management Center to your Security Cloud Control Firewall Management organization and creating policies, you can start analyzing them using the Policy Analyzer and Optimizer.

For more information, refer to Onboard an On-Premises Firewall Management Center and Enable Cloud-Delivered Firewall Management Center on Your Security Cloud Control.

Policy analysis summary components

When analysis completes, select an access control policy to review the right-pane summary and click View analysis details and optimize.

Alternatively, you can click the ellipse button associated with a policy and select View details to see the right-pane summary.

The analysis summary includes these components:

• Overall summary: Provides insights on how many rules are healthy, disabled, expired, and contain anomalies, using a pie chart for the selected access control policy. You can also hover over the part of the pie to view the percentage of rules.

• Rule usage history: Shows how recently rules were used, with time periods.

• Rules with Anomalies: Provides insights on how many rules have anomalies.

• Hits rules & dead rules: Provides insights on hitcount of expired rules, for rule types including allow, block, monitor, and trust.

In remediation tabs such as Duplicate rules, Expired rules, Mergeable rules, Overlapping objects, and Policy insights you can select the check box next to a category to stage all observations in that category, or expand the category and select specific observations or rules. Available actions depend on the anomaly type.

Duplicate rule analysis

The Duplicate Rules tab lists shadowed and redundant rules with anomalies:

• A Fully Shadowed rules is one that will never evaluate network traffic because another rule that precedes it over shadows this rule.

  

• A Fully Redundant rules is one that is just a part of another larger rule, such that removing this redundant rule does not have an impact on the network traffic, because the traffic evaluation that this rule must perform is already performed by another rule.

  

You can remediate all duplicate-rule observations in a category, selected fully shadowed or fully redundant observations, or individual rules within an expanded observation. For selected duplicate rules, choose Move to disabled state or Move to delete state. Disable rules first when you want to measure the impact before deleting them.

Note

Expand each observation to review the affected rules before you stage a remediation. Each rule in the list is displayed with a set of attributes; click the settings button on the top right to select which rule attributes you want to display along with the rule.

When duplicate-rule remediation removes shadowed or redundant rules and retains a base rule, Policy Analyzer and Optimizer adds a standardized comment to the retained rule. The comment identifies the retained rule and the removed rules, which helps you audit the cleanup.

After you stage the selected duplicate-rule remediations, you can still Undo them before clicking Apply Remediation. It is recommended that you disable rules first to measure the impact and delete them later, because deleting them permanently removes them.

You can enable the disabled rules any time by navigating to the Cloud-Delivered Firewall Management Center or the On-Premises Firewall Management Center on which the rules are present.

Expired rules remediation options

You can remediate expired rules using these methods:

• All expired-rule observations in the category

• Selected expired-rule observations

• Selected expired rules

For selected expired rules, you can choose these actions:

• Move to disabled state

• Move to delete state

Note

Only selected rules are changed when you apply remediation.

The Expired Rules tab displays this information in the interface.

Mergeable rules management process

You can review the mergeable-rule observations and stage remediation for the entire category, selected observations, or individual rules within an expanded observation. Click Merge Selected to merge only the staged items. Unselected mergeable-rule observations remain unchanged until you stage and apply remediation for them.

Note

When you select individual rules to merge, select only consecutive rules. The first selected rule in the sequence is updated with the merged rule criteria, and the remaining selected rules are removed. You can start the merge from any rule in a consecutive set. The first rule in the observation does not need to be selected.

Overlapping object types and remediation

The system identifies two types of overlapping objects:

• Fully overlapping objects: Objects where the IP addresses or port numbers are either the same or a complete subset. For example, if a rule contains an object for 192.168.1.1 and another for 192.168.1.0/24, the 192.168.1.1 object is fully overlapped by the other object and is not needed in the rule.

• Partially overlapping objects: Objects where some subset of IP addresses are repeated, but not all addresses overlap.

For fully overlapped objects, you can remediate all fully overlapped observations in the category, selected observations, or selected rules. Click Remove All Fully Overlapped Objects from Rules to remove fully overlapped objects only from the staged items.

For partial overlaps, you need to evaluate each occurrence, determine if any changes can be made, and implement those changes directly by editing the objects.

Policy insights filtering options

The Policy Insights tab has a Hit Count section that initially lists any rules that have never been triggered (Never Hit Rules). The hit count information is from all devices that are assigned to the policy. You can change criteria and see other hit count information, for example, Not Hit Rules for the past six months, or Hit Rules over a selected time period. You can filter the rules using the actions set in the rules, hit information, and time period:

• Never Hit Rules—Rules that have never been hit from the time they were created.

• Hit Rules—Rules that have been hit in the selected time period.

• Not Hit Rules—Rules that have not been hit in the selected time period.

Select the rules that you want to disable or delete, and select Disable Rules or Delete Rules. These changes are staged until you select Apply Remediation. First, disable the rules when you want to measure their impact before deleting them.