Configuring to View Unused Firewall Rules

In a Firewall device, there could be numerous rules/access-list defined to secure the network from external attacks. Out of the rules/access-list configured, there could be certain rules which would be most used and certain which are least used or never used. Firewall Analyzer captures the most used rules in the Top Used Rules as they would be available in the logs generated by Firewall. But, to get the  Unused Rules, one needs to configure the Firewall Analyzer to fetch the complete rules from the device. Once, Firewall Analyzer fetches the complete rules configured in the Firewall, it can provide the Unused Rules view.

To view Unused Firewall Rules, configure the Firewall Analyzer by following the steps given below:

1. In the Firewall Analyzer web client, select the Settings tab.
2. In Settings screen, select the System Settings > Device Rule link. Device Rule Info page appears.
3. On the top, there are two links provided to add device info to fetch rules and to delete the device info. The links are:
   1. Add Device Info
   2. Delete Device Info

Add Device Info

4. Click the Add Device Info link to add the device information to fetch the rules using Telnet or SSH. The Enter Device Details screen opens up.
5. In the Enter Device Details screen, select the Firewall device in the Select Device drop down list.
6. In the Fetch Rules section, there will be two options to fetch rules
   1. From Device
   2. From File

Select the option as per your requirement.

Fetching the rules directly from the device is supported for the following devices only: Cisco Fortigate Netscreen For the rest of the devices, please use the Fetch Rules > From File option.

Fetch Rules > From Device

7. In the From Device tab, select the protocol (Telnet or SSH) in the Protocol drop down list.
8. Enter the Device Info. The Device Info has been split into two sections:

• Primary Info - deal with parameters that are necessary to establish communication with the device. Details such as Login Name, Password, Prompt, Enable UserName, Enable Password and Enable Prompt are classified as basic details.
  
• Secondary Info - certain parameters usually take standard values. All such parameters have been classified under 'Secondary Info'. Port, login prompt, enable user prompt, password prompt, enable password prompt values are usually assigned with certain Standard Values by default. Such standard values have been filled for these parameters. Most of the devices would work well with these values and you need not edit these details unless you want to provide different set of details.

Primary Info

Both Primary and Secondary credentials (Login Name and Password) of the Firewalls are encrypted and stored in the Firewall Analyzer.

Secondary Info

Click the link Secondary Info to view/enter values for these parameters. All the parameters are usually assigned with certain Standard Values by default. Such standard values have been filled for these parameters. Most of the devices would work well with these values and you need not edit these details unless you want to provide different set of details.

9. The command to be executed, to fetch the Firewall rules is displayed in the Command field.
10. Select whether the rules are fetched once or periodically.
    1. Select Once radio button to fetch the rules once.
    2. Select Periodic radio button to fetch the rules periodically. The periodicity option opens up. Select the periodicity of rules fetching from the combo boxes given in: Every <1 to 31> day(s) @ <0 to 23> Hrs <0 to 50> Min. (For example: If you configure like Every 10 day(s) @ 2 Hrs 30 Min, the rules will be fetched from the device, every 10 days at 02:30 AM)
11. Click Test Now button, to test the validity of the device info; otherwise, click Save button to apply the values. Click Cancel to cancel the adding device info operation.

If the Firewall Analyzer is not receiving the logs directly from the Firewall device (i.e., the logs are received from a log forwarder tool), to fetch the rules from the Firewall device, configure the IP Address of the actual Firewall. Configure the IP Address, using Secondary Info > IP Address field.

Fetch Rules > From File

12. In the From File tab, enter the file name with absolute path of the file which contains the rules details of the Firewall device. Alternatively, click the Browse button to locate the file.
13. Click Import button to import the file. Click Cancel to cancel the rules details file importing operation.

User should create a file containing rules details. The file should contain rule name and description in comma separated format. Each rule should be in a new line.

Delete Device Info

• To delete the Device Info from the list of Device Details table, select the check boxes of the respective Device Info entries and click the Delete Device Info link.

Testing the validity of device info

Device Info values entered through the Firewall Analyzer GUI should be accurate. Otherwise, Firewall Analyzer will not be able to establish connection with the device. To ensure the correctness of device info values, Firewall Analyzer provides the testing option. After entering the device info, you can test the values during which Firewall Analyzer will indicate if the values entered are valid. It will pinpoint the invalid values and you can carryout corrections accordingly.

To test the validity of device info, follow the procedure given below:

• After providing the device info, click Test Now button.
  

This updates the device info values in the database and then carries out the testing. The result of the testing will be shown in a separate window as below:



The testing result indicates valid device info values with a green 'tick' mark. The invalid values are marked as red cross marks. You need to change the invalid values. Alongside, the CLI command execution result (through which Firewall Analyzer ascertains the validity of device info values) is also displayed.

Devices Details

After entering and saving the Device Info values through the Firewall Analyzer GUI, the device, with details to fetch rules, is listed in the Device Details table. The details of the columns of the Device Details table are: