A firewall rule that was reasonable during a project rollout can become a security and compliance liability six months later. Temporary vendor access remains open, duplicate rules accumulate, and broad source or destination objects hide exposure that nobody has had time to investigate. The decision to automate firewall policy reviews is not about removing technical judgement. It is about ensuring that judgement is applied consistently, using current evidence rather than an annual spreadsheet exercise.
For Australian organisations managing branch offices, cloud workloads, remote users and regulated data, policy review needs to be part of normal operations. Fortinet environments can provide the central visibility, workflow control and log evidence needed to make that practical. The value comes from combining the right platform configuration with a review process that reflects how the business actually operates.
Why manual policy reviews fall behind
Most firewall teams understand the need to review policies. The challenge is scale. A single FortiGate may have a manageable policy set, but a multi-site organisation can quickly accumulate separate policy packages, local exceptions, address groups, VPN rules and changes made during incident response.
A manual review often starts with an export, followed by someone attempting to determine whether each rule still has an owner, a business purpose and recent traffic. By the time that work is complete, the environment may already have changed. It is also difficult to prove that all changes were assessed consistently, which creates an avoidable gap for internal governance, ISO 27001 programs, Essential Eight-aligned controls and customer assurance requests.
Automation changes the operating model. It can identify policies with no recent hits, overly permissive services, duplicate or shadowed rules, expired temporary access, and policy changes that require approval. Teams then spend their limited time validating the exceptions that matter instead of searching for them.
What it means to automate firewall policy reviews
Automated policy review is not the same as automatically deleting rules. A good process collects configuration and traffic data, applies agreed review criteria, creates clear findings, and routes decisions to the people accountable for applications or services.
In a Fortinet deployment, FortiManager can centralise policy packages, object management, administration profiles and approval workflows across managed FortiGate devices. FortiAnalyzer can add traffic and event context, helping teams distinguish a genuinely unused rule from a rule supporting a low-volume but legitimate business service. Used together, they provide a much stronger basis for repeatable review than isolated device-level administration.
The automation should produce evidence, not just alerts. Each finding needs enough detail for an administrator or service owner to make a defensible decision: the policy name and ID, source and destination, services, action, device or policy package, last observed use, change history and recommended next step.
Start with a review standard, not a tool setting
Before enabling reports or workflows, establish what a compliant firewall rule looks like in your environment. Without that standard, automation simply produces more noise.
A practical rule standard usually requires a named owner, a documented business purpose, appropriately scoped source and destination objects, only the ports and protocols required, a review date, and a defined expiry date for temporary access. Critical rules may also require a linked change reference and evidence of application-owner approval.
Your criteria should reflect risk. A rule allowing outbound web access for staff will be assessed differently from one that permits inbound access to a production application or lateral access to a finance system. Similarly, an unused disaster recovery rule may be legitimate, but it should be clearly labelled, tested at an agreed interval and reviewed by the responsible owner.
Avoid treating zero hits as an automatic deletion signal. Log retention periods, asymmetric routing, encrypted traffic, reporting gaps and infrequent business processes can all make a valid rule appear inactive. Use inactivity as a prompt for verification, then make a controlled change where the evidence supports it.
A practical workflow to automate firewall policy reviews
The most effective programs use scheduled checks and a human approval point. The following controls are particularly valuable when building an automated review workflow:
- Flag policies that have not recorded an expected level of traffic over an agreed period, such as 90 or 180 days.
- Identify broad rules, including any-to-any access, excessive service groups, public source ranges or unneeded administrative ports.
- Detect duplicate, overlapping and shadowed rules that make policy behaviour harder to predict.
- Report policies changed outside the approved workflow, or rules that lack an owner, expiry date or business justification.
- Escalate temporary rules before expiry so the owner can renew with approval or allow the access to be removed.
For each proposed change, use a staged process. Review the evidence, confirm the application dependency with the relevant owner, assess the likely operational impact, then schedule and approve the implementation. FortiManager’s centralised policy management and revision control can support this discipline, particularly where multiple administrators manage site firewalls or shared policy packages.
Where the risk of disruption is high, begin in report-only mode. Measure how many findings are genuine, tune exclusions for known low-frequency services, and improve rule naming and ownership data. Once the findings are reliable, automate notifications and approval tasks before considering any limited auto-remediation.
Use traffic evidence carefully
Traffic logs are essential, but they are not the whole story. A firewall may be enforcing traffic that is not fully logged, or a service may only run during payroll processing, disaster recovery tests or a seasonal business event. Policies with no hits therefore need context, not assumptions.
Set logging policies deliberately for the traffic classes that matter to review and compliance. Retain logs for a period that matches your review window and obligations, while balancing storage cost and reporting performance. FortiAnalyzer can help consolidate the operational evidence needed to investigate policy use across devices, rather than relying on local logs that may have already rolled over.
It is also worth checking that the policy order and security profiles are being reviewed alongside access scope. A narrowly defined allow rule with no inspection may be less acceptable than a similar rule protected by appropriate IPS, application control, web filtering or SSL inspection settings. The right control mix depends on application compatibility, privacy considerations and the organisation’s risk appetite.
Make accountability visible to auditors and leaders
Policy automation works best when technical findings are translated into management-ready evidence. Security leaders need to see more than the number of rules. They need to know whether high-risk access is reducing, whether overdue approvals are being addressed, and whether exceptions have a current owner.
Useful measures include the percentage of rules with an identified owner, the number of temporary rules approaching expiry, inactive rules removed or validated, broad-access rules remaining, and the time taken to close review findings. These measures show whether the program is improving resilience rather than simply generating administration.
Keep review records with the policy change history. For regulated organisations, this can demonstrate that access decisions were considered, approved and implemented through a controlled process. For smaller businesses, the same discipline reduces dependence on one administrator who happens to know why an old rule exists.
Build for the environment you have now
Not every organisation needs a large security operations team to run effective policy reviews. A smaller business may begin with monthly FortiGate configuration checks, scheduled reports and a simple approval register. A multi-site enterprise may require centralised FortiManager workflows, FortiAnalyzer reporting, service management integration and separate policy packages for different business units.
The key is to select an approach that matches the number of firewalls, rate of change, compliance exposure and available internal capability. FortiSecure Store can help Australian organisations align genuine Fortinet licensing, appliances and certified implementation support to that operating model, without paying for unnecessary complexity.
Start with the rules that expose the most risk: internet-facing access, administrative services, third-party connectivity and temporary exceptions. Once the review process is producing trusted results, extend it across the wider policy estate. A firewall policy set should be a controlled business asset, not a growing archive of decisions no one is prepared to own.