Firewall Policy Usage - ASA

[cph24795]

What is the best method by which to determine what policies are being used in various contexts and how much they are being used.  Thinking about an auditing/cleanup process use case.  

[Francesco Molino]

Hi

You can go with the simple way by looking at hitcounts for cleaning non used rules.

Then, the best way would be to have a syslog like ELK (or any others you prefer) to look at the traffic to tweak rules that are getting hits and restrict policies.

You can also use Cisco CLI analyzer which will give you a clear view of what policies are used, what objets are used or not…