A habit I bring to every infrastructure audit: pull the policy hit counters off the firewalls and line them up against the rule bases. The result is depressingly consistent. The large majority of rules, routinely well over ninety percent, have never matched a single packet. They sit in production configurations, matching nothing, ever.
And the mirror image is just as striking: a small handful of broad rules typically accounts for almost all of the hits. The rule base is a phone book, and everyone is calling the same three numbers. If you have never measured your own environment, I would genuinely not assume you are different. Almost nobody thinks they are the one at ninety-plus percent either.
How a rule base rots
No one writes thousands of dead rules on purpose. They accumulate through perfectly normal operations:
- Rules created for projects and servers that were decommissioned years ago, because firewall cleanup is never in a decommissioning checklist.
- Templated rule sets stamped onto every site “for consistency,” including sites that never ran the service in question. It is common to find entire families of templated policies with zero hits anywhere, protecting traffic that was never enabled.
- Rules that were dead on arrival: written for traffic that never showed up, kept because deleting feels riskier than keeping.
- Rules shadowed by broader rules above them, unreachable by construction.
- Intra-zone permit rules for traffic that, due to the routing design, never actually traverses the firewall at all (a cousin of the east-west blind spot problem).
The asymmetry of incentives does the rest. Adding a rule solves someone’s ticket today. Removing a rule risks an outage with your name on it and helps no one visibly. So rule bases only ever grow, and every rule is one more thing to audit, one more interaction to reason about during changes, and one more place for an over-broad permit to hide. Dead rules are not neutral clutter; they are unreviewed attack surface and cognitive load during every incident.
Cleaning up without becoming the outage
Hit counters have honest caveats: they reset on reboots and failovers, some traffic is rare but legitimate (disaster recovery flows, year-end jobs), and a zero-hit rule might simply be waiting for its moment. Which is why the answer is not a mass delete. The pattern I used, and now recommend everywhere, is disable, observe, remove:
- Disable candidate rules rather than deleting them. Batch by risk: templated stubs and rules referencing decommissioned objects first, anything plausibly tied to rare-but-real events last.
- Observe for a window that covers your rare traffic cycles. Ninety days catches quarterly jobs; think hard about anything annual. A disabled rule that someone suddenly misses is a five-minute re-enable, not a restore-from-backup.
- Remove once the observation window closes clean, with the change batched, documented, and reversible.
Wrap every step in the deployment safety net your platform gives you (commit-confirmed on Junos, policy rollback on other stacks), so even a bad batch self-heals.
Just as important: fix the intake side, or you will be back where you started in five years. Rules should carry an owner and a purpose in their description. Broad zone-wide default permits deserve special hostility, since they silently absorb the traffic that should be justifying specific rules, and they are why the other rules never hit. The healthiest rule base I have measured was one built without any zone-wide default permits, and it was no coincidence it had both the cleanest hit distribution and the most readable policy. That kind of site is the reference model worth copying fleet-wide.
The bigger lesson
Hit counters are the cheapest security telemetry you own. They are already being collected, they require no new tooling, and they answer a question most organizations have never asked: which parts of my security policy are real, and which are sediment?
A firewall rule base is supposed to be a model of intended traffic. Once most of it is dead weight, it has stopped being a model of anything; it is an archaeological site where policy intent goes to be forgotten. Measure yours. The number will annoy you into fixing it.