Configure IPT rule recommendations

The Policy Optimization page's Intelligent Policy Tuner (IPT) provides recommendations for replacing permissive rules with new, tighter rules, as well as recommendations for new objects to be used in the rules. For specified brands (as shown in the Support Matrix on the Portal) we also provide recommendation to remove unnecessary applications.

For each sparse object, IPT generates recommendations as follows:

1. IPT searches the device configuration for an existing object that contains the exact same IP addresses, services, and applications as the original object. If such an object is found, IPT suggests it as a replacement.

2. If no such object is found, IPT suggests a new object as follows:

   • Host objects: If the number of used IP addresses/ranges is smaller than a certain number (IPT_Recommendation_Max_Subnets_Per_Range), then IPT recommends creating a new object that contains these IP addresses/ranges. If the number is larger, IPT searches for a set of CIDR blocks that covers all of the used IP addresses/ranges contained in the original object, and is composed of no more than a certain number of CIDR blocks (IPT_Recommendation_Max_Ranges). If such a set is found, IPT suggests a new object that contains the set.
   • Service/application objects: If the number of services/application is less than a certain number (IPT_Recommendation_Max_Services), IPT suggests a new object that contains these services/applications. If the number is larger, IPT does not suggest a new object.

3. IPT's recommendations are saved in an XML file and then displayed in the Policy Optimization page.

   If desired, you can change the values used in IPT's calculations, by using the following procedure.

To configure IPT rule replacement recommendations:

Do the following:

1. In the toolbar, click your username.

   A drop-down menu appears.

2. Select Administration.

   The Administration page appears, displaying the Options tab.

3. Click the Advanced Configuration tab.

   The Advanced Configuration page appears.

4. Add the desired items specified in the following table, one at a time, by doing the following:

   1. Click Add.

      The Add New Configuration Parameter dialog is displayed.

   2. In the Name field, type the configuration item.

   3. In the Value field, type the item's value.

   4. Click OK.

   Repeat these steps as needed.

5. Click OK.