topic Re: Firepower in Network Security

Firepower

Kepler — Thu, 02 Feb 2023 12:34:39 GMT

Hi guys,

I have FPR 1140 with 1303 active rules :((
I need to optimize (delete not used old rules) it.

As you can see on the screen, there are no options like: "active sessions", "hit counts", "first used" or "last used".
so, can you please tell me how can I do this job? What is best practice?

Thank you.

Re: Firepower

Karsten Iwen — Thu, 02 Feb 2023 12:57:13 GMT

You can see the hit-count on the FTD-CLI with the command

show access-control-config

I assume that you run a quite old software, when you update to 7.2 you can do this (and more) on the FMC itself.

Re: Firepower

Chess Norris — Thu, 02 Feb 2023 14:24:24 GMT

There is also another option for older FMC version using a custom workflow

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/212330-firepower-management-center-display-acc.html

However I think the option to display hitcounts directly from the ACP has been around for some time now. They are mention it in the release notes here for version 6.4

https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/getting_started_with_access_control_policies.html

Look for this button in your ACP

/Chess

Re: Firepower

Marius Gunnerud — Thu, 02 Feb 2023 20:37:34 GMT

There should also be an API call that you can do to get the hitcount of rules

https://www.cisco.com/c/en/us/td/docs/security/firepower/70/api/REST/firepower_management_center_rest_api_quick_start_guide_70/Objects_In_The_REST_API.html#hitcounts_put