The Policy Analyzer and Optimizer performs these services: analysis, remediation, and reporting.

Analysis

The Policy Analyzer and Optimizer polls cloud-delivered Firewall Management Center and on-prem management center for policies and displays them on the Policy Analyzer and Optimizer page. To open the Policy Analyzer and Optimizer page, navigate Tools & Services > Firewall Management Center, select Cloud-delivered FMC or any on-prem management center, and choose Policy Analyzer and Optimizer from the right pane. Alternatively, on the CDO left pane, choose Insights > Policy Analyzer and Optimizer. Choose Cloud-delivered FMC or any on-prem management center from the Showing policy for tab on the top-left corner.

When you have created a new access control policy or imported a policy, it will take a while for the Policy Analyzer and Optimizer to identify it, after which you can manaually trigger the policy analysis. You can also wait for the auto-analysis that occurs every 24 hours. When the analysis is done, Policy Analyzer and Optimizer provides insights on the number of rules in the policy, the percentage of the policy that can be optimized, and a detailed summary that contains information such as Rule Health Summary, Rule Last Usage, Rule Hits & Dead Rules, and so on.

Note	The Optimizable percentage under Observations column is an approximation of how many rules in the policies can be optimized if the suggested remediations are applied.

The Summary tab includes the following rule information, presented in pie charts and bar graphs:

Rule Health Summary—provides insights on how many rules are healthy, disabled, expired, and contain anomalies, using a pie chart. You can also hover over the part of the pie to view the percentage of rules.

Rule Last Usage—provides insights on the recentness on the rule usage, with time periods.

Rules with Anomalies—provides insights on how many rules have anomalies, using a bar graph. Hover over the bars to see the number of rules having anomalies.

Rule Hits & Dead Rules—provides insights on hitcount of expired rules, for rule types including allow, block, monitor, and trust.

The Duplicate Rules tab lists shadowed and redundant rules with anomalies:

• A Fully Shadowed Rule is one that will never evaluate network traffic because another rule that precedes it over shadows this rule.

• A Fully Redundant Rule is one that is just a part of another larger rule, such that removing this redundant rule does not have an impact on the network traffic, because the traffic evaluation that this rule must perform is already performed by another rule.

You can choose to either disable or delete all the fully shadowed or fully redundant rules.

Note	Expand each observation to see the list of rules that are redundant because of the larger rule. Each rule in the list is displayed with a set of attributes; click the settings button on the top right to select which rule attributes you would like to see along with the rule.

After you disable the shadowed rules, you still get to Undo it before applying the changes. It is recommended that you disable the rules first to measure the impact and delete them, because when you delete them later, they get permanently deleted.

You can enable the disabled rules any time by navigating to the cloud-delivered Firewall Management Center or the On-Prem Firewall Management Center on which the rules are present.

The Overlapping Objects tab lists objects that are either fully overlapping (the IP addresses are either the same or a complete subset) or partially overlapping (some subset of IP addresses are repeated, but not all).

For example, if a rule contains an object for 192.168.1.1 and another for 192.168.1.0/24, the 192.168.1.1 object is fully overlapped by the other object and is not needed in the rule. You can click the Remove All Fully Overlapped Objects from Rules button.

For partial overlaps, you need to evaluate each occurrence, determine if any changes can be made, and implement those changes directly by editing the objects.

The Expired Rules tab lists rules that were configured with a time range and the time range has expired. You can also see rule information such as the date on which the rule expired, hit count, last hit time, and the time range.

You can choose to either Disable All Expired Rules or Delete All Expired Rules.

The Mergeable Rules tab lists the rules that have similar allow and block settings and can be merged into a single rule. You can read the observations and click Merge All Rules at once to merge the objects in those rules, to reduce the number of rules you manage.

Note

When you merge two rules, the logging settings from the first rule are applied to the rule that the first rule is getting merged with. Therefore, the logging behavior for the merged rule will follow the settings configured on the first rule, and any unique logging configurations from other rules will be overwritten.

The Policy Insights tab has a Hit Count section that initially lists any rules that have never been triggered (Never Hit Rules). The hit count information is from all devices that are assigned to the policy. You can change criteria and see other hit count information, for example, Not Hit Rules for the past 6 months, or Hit Rules over a selected time period. You can filter the rules using the actions set in the rules, hit information, and time period:

• Never Hit Rules—Rules that have never been hit from the time they were created.

• Hit Rules—Rules that have been hit in the selected time period.

• Not Hit Rules—Rules that have not been hit in the selected time period.

Select the rules you want to disable or delete and click Disable Rules or Delete Rules. It is recommended that you disable the rules first to measure the impact of disabling them and then delete them.

The policy remediation report consolidates all the pieces of a completed remediation and can be downloaded as a PDF. This report contains the following the sections, based on what remediations you have performed on your policies. Each section carries information about the rule name, the remediation action taken, and any related comments. For example, if you have not remediated any duplicate rules, the report does not contain the section pertaining to the duplicate rules remediation:

• Remediation Summary

• Hit Count Remediation

• Expired Rules Remediation

• Duplicate Rules Remediation

• Mergeable Rules Remediation

Note

To know if a policy is remediated by the Policy Analyzer and Optimizer, navigate to Policies > Access Policies and edit a policy to view the rules in the Policy Editor. When a policy is remediated by Policy Analyzer and Optimizer, a comment gets added to the rules that are optimized. You can also filter all the rules optimized by the Policy Analyzer and Optimizer using "updated by Policy Analyzer and Optimizer" to view all the rules remediated by the Policy Analyzer and Optimizer.