“Over ten years of continuous IT operations, every temporary access rule becomes permanent. Nobody ever deletes a firewall rule out of fear of breaking production.”

At Wipro, I was tasked with auditing a legacy enterprise firewall estate containing over 10,000 rules across Checkpoint SmartConsole, Palo Alto PAN-OS, and Cisco ASA appliances.

The Shadow Rule Problem

Years of emergency ticket fixes resulted in “Any/Any” rule shadow bloat.

• Shadow Rules: Top-level broad rules that rendered lower-level specific security policies completely useless.
• Unused Objects: IP objects referencing decommissioned servers that had been offline for 5+ years.
• Orphaned Services: Custom TCP ports left open indefinitely after one-off migrations.

[!NOTE] Rule Hitting Telemetry: Before deleting any security rule, we enabled explicit hit counters and analyzed syslogs over a 90-day window to identify zero-hit candidate rules.

# # Palo Alto CLI Unused Policy Identification
show running security-policy | match "hit-count: 0"

The Verdict

Key Takeaway

Enforce Expiration Metadata on All Firewall Requests.

Never approve a security rule without requiring an explicit owner, change request reference, and automatic expiration date. Automated policy auditing keeps firewall tables clean and secure.