Generating Audit Reports on Palo Alto Firewall
Home > Enterprise security devices or applications > Paloalto firewall > Generating Audit Reports on Palo Alto Firewall
Overview
This article outlines a structured approach for generating audit reports focused on identifying unused, inactive, disabled, and misnamed rules and objects within Palo Alto Networks firewalls. These audit reports play a critical role in enhancing overall firewall security posture by enabling administrators to perform effective policy cleanup, eliminate redundant configurations, and maintain optimal configuration hygiene. By systematically identifying and addressing such inefficiencies, organizations can streamline firewall performance, reduce potential attack surfaces, and ensure compliance with internal and external security standards. These reports are essential for security optimization, policy cleanup, and maintaining configuration hygiene.
Generating a Report for Unused Security Rules
Purpose:
To identify security rules that have had no traffic since their creation.
Steps:
Log in to the Palo Alto Firewall Web UI: https://<firewall-ip> using admin credentials. Navigate to the Policies tab. Go to: Policy Optimizer > Rule Usage > Select: Unused
At the bottom of the screen, click Export (choose PDF or CSV) to download the list of unused security rules.
Generating a Report for Unused NAT Rules
Purpose:
To locate NAT rules that have not been triggered by any traffic.
Steps:
Navigate to the Policies tab. Go to: NAT > Policy Optimizer > Rule Usage > Select: Unused
At the bottom of the screen, click Export (choose PDF or CSV) to download the list of unused security rules.
Generating a Report for Rules with No Traffic Hits in the Last 90 Days
Purpose:
To identify rules that have not matched any traffic in the last 90 days.
Steps
Navigate to the Policies tab. Go to: Security > Policy Optimizer > Rule Usage > Select: Unused in 90 days
Scroll to the bottom and click Export (PDF or CSV) to download the report.
Generating a Report on Unused Policy-Based Forwarding (PBF) Rules
Purpose:
To identify unused Policy-Based Forwarding rules.
Steps:
Navigate to the Policies tab. Go to: Policy Based Forwarding > Policy Optimizer > Rule Usage > Select: Unused
click Export button to export the report as PDF or CSV from the bottom of the page.
Generating a Report for Unused Decryption Rules
Purpose:
To audit unused decryption policies.
Steps:
Navigate to the Policies tab. Go to: Decryption > Policy Optimizer > Rule Usage > Select: Unused
Export the results to CSV or PDF from the bottom toolbar.
Generating a Report on Disabled Rules
Purpose:
To identify manually disabled rules.
Steps:
1.Navigate to the Policies tab. 2.Export all security rules to a CSV file. 3.Open the CSV in Excel or another spreadsheet tool. 4.Use Excel’s Filter function to filter by the "Enabled" or "Disabled" column to isolate all disabled rules.
Generating a Report on Improperly Named Objects
Purpose:
To detect objects with inconsistent or non-standard naming conventions.
Steps:
1. Navigate to the Objects tab. 2. Click the Export to CSV/PDF option at the bottom of the page to export all objects. 3. Review the exported file manually and identify objects that do not follow your organizational naming standards (e.g., missing prefixes, inconsistent labels, IP format mismatches).
Summary
These built-in features in Palo Alto’s GUI interface allow administrators to easily extract policy data and identify optimization opportunities. Regular use of these reports is recommended for maintaining a clean, efficient, and secure firewall rulebase.
Home > Enterprise security devices or applications > Paloalto firewall > Generating Audit Reports on Palo Alto Firewall
