We worked on cleanup firewall rules on ASA, some acl rules no hit increased over months and show connection also get none, but when we removed the rules impact and caused incident and found most rules related to ssh. any reason can cause it and what's the cleanup steps besides compare hit count and show connection can avoid the impact?
e.g. our rule:
Solved! Go to Solution.
Aside from looking at the ACL hits, you could analyze packet captures. Look at source and destination IP addresses and port numbers. It might be pretty tedious but you would be able to see all the traffic traversing the ASA even if that traffic doesn't show as a hit on any ACL rule. Then once you've identified the traffic that should be allowed, tailor your ACL rules accordingly.