Generating Audit Reports on Palo Alto Firewall

Home > Enterprise security devices or applications > Paloalto firewall > Generating Audit Reports on Palo Alto Firewall

Overview

This article provides step-by-step instructions for generating audit reports related to unused, inactive, disabled, and misnamed rules and objects within a Palo Alto Networks firewall. These reports are essential for security optimization, policy cleanup, and maintaining configuration hygiene.

Generating a Report for Unused Security Rules

Purpose:

To identify security rules that have had no traffic since their creation.

Steps:

Log in to the Palo Alto Firewall Web UI:
https://<firewall-ip> using admin credentials.

Navigate to the Policies tab.

Go to:
Policy Optimizer > Rule Usage > Select: Unused

At the bottom of the screen, click Export (choose PDF or CSV) to download the list of unused security rules.

Generating a Report for Unused NAT Rules

Purpose:

To locate NAT rules that have not been triggered by any traffic.

Steps:

Navigate to the Policies tab.

Go to:
NAT > Policy Optimizer > Rule Usage > Select: Unused

At the bottom of the screen, click Export (choose PDF or CSV) to download the list of unused security rules.

Generating a Report for Rules with No Traffic Hits in the Last 90 Days

Purpose:

To identify rules that have not matched any traffic in the last 90 days.

Steps

Navigate to the Policies tab.

Go to:
Security > Policy Optimizer > Rule Usage > Select: Unused in 90 days

Scroll to the bottom and click Export (PDF or CSV) to download the report.

Generating a Report on Unused Policy-Based Forwarding (PBF) Rules

Purpose:

To identify unused Policy-Based Forwarding rules.

Steps:

Navigate to the Policies tab.

Go to:
Policy Based Forwarding > Policy Optimizer > Rule Usage > Select: Unused

click Export button to export the report as PDF or CSV from the bottom of the page.

Generating a Report for Unused Decryption Rules

Purpose:

To audit unused decryption policies.

Steps:

Navigate to the Policies tab.

Go to:
Decryption > Policy Optimizer > Rule Usage > Select: Unused

Export the results to CSV or PDF from the bottom toolbar.

Generating a Report on Disabled Rules

Purpose:

To identify manually disabled rules.

Steps:

1.Navigate to the Policies tab.

2.Export all security rules to a CSV file.

3.Open the CSV in Excel or another spreadsheet tool.

4.Use Excel’s Filter function to filter by the "Enabled" or "Disabled" column to isolate all disabled rules.

Generating a Report on Improperly Named Objects

Purpose:

To detect objects with inconsistent or non-standard naming conventions.

Steps:

1. Navigate to the Objects tab.

2. Click the Export to CSV/PDF option at the bottom of the page to export all objects.

3. Review the exported file manually and identify objects that do not follow your organizational naming standards (e.g., missing prefixes, inconsistent labels, IP format mismatches).

Summary

These built-in features in Palo Alto’s GUI interface allow administrators to easily extract policy data and identify optimization opportunities. Regular use of these reports is recommended for maintaining a clean, efficient, and secure firewall rulebase.

Home > Enterprise security devices or applications > Paloalto firewall > Generating Audit Reports on Palo Alto Firewall