Rule Usage - Fortigate 600C

[Steven_Lengua]

Is there a way to check and see what rules are actually being hit? I' m new to Fortinet and one of the items I have been tasked with is, checking to see what rules are being used and which rules are still needed. I' m a Checkpoint guy, so not very familiar with Fortinet although I' ve gotten a bit better with more than two weeks under my belt now. Does anyone know how or if there is a way to see what rules are being hit / used?

[Carl_Wallmark]

Hi, Very simple: Go to your policy view, and look at the right, you should have column called " Count" , there you can see packets and amount of data for every policy. If you dont have the column, simply right click on a column name and select " Count"

[Jordan_Thompson_FTNT]

As Selective mentioned, the " Count" column is useful for this. You didn' t mention which firmware version you are using, but assuming FortiOS 5.0 or 5.2 there are two additional columns that would help you:- * Last Used (indicates the last time the policy was hit by any traffic) * Sessions (indicates current number of active sessions on that policy)

[Carl_Wallmark]

Nice one, did not notice the " Sessions" column.

[ede_pfau]

Before changing the column layout, you might switch to ' Global View' to overlook ALL policies at once. Column settings are specific for each view. IMHO ' Last Used' and ' Sessions' are new to FOS 5.2, right?

[Jordan_Thompson_FTNT]

IMHO ' Last Used' and ' Sessions' are new to FOS 5.2, right?

No, both columns are available in 5.0 as well. Here' s another tip if you find that you constantly need to customize the default policy columns:- http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%205.0%20Help/gui.070.03.html Both of these tips (and a few others) were included in this recent video guide:- http://video.fortinet.com/playlist/featured-playlist/chapter/2/-3