SRX

Hello!

Explain please, how to check unnecessary security policies to detect them and remove from SRX .

For example,

There is SRX650, that I see for a little time, but understand , that there are many security policies , that are not in use.(but not sure with 100% that is so).

Is there any effective method identify unused security policies?

My suggestion would be:

- enable "count" option to all the security rules.

- clear all the count statistics.

- check policies with count of 0.  After 30 days or so, if it's still 0, then the rule may no longer be needed.

To clear count stats:  "clear security policies hit-count"

To check policies with count of 0: "show security policies hit-count less-than 1"

I still see 2 gotchas:

1. device may have a limit as to the maximum number of rules that can have 'count' configured

2. it may be normal for some rules not to be hit within the 30 days or so you monitor.

Hope this helps.

Regards,

Sam

Thanks! It necessary to try! very good way!

Till your suggestion, I have thought about creating  traceoptions for every session flow ( where specify the parameters of the session)  and after 30 days check every log file. ( Your method is more preferable)

By the way if you are with junos 12.1 or later you can just use the below ot show you all policy hit counters without having "then count" enabled.  

>show security policy hit-count 

Also note that you can not configure unlimited "then count" policy actions. I dont remember the exact number but it is somethin like a few hundred per device.

OK! THNX!