How do you reset the hit count on a security policy rule?

The PAN-OS web interface provides a direct and non-disruptive method for resetting the hit count of a specific security policy rule. An administrator can navigate to the Security policy rulebase, select the desired rule(s), and then use the "Hit Count" menu at the bottom of the page to select the "Reset" option. This action clears the counter for the selected rules without impacting their enforcement or causing any traffic disruption, making it the standard operational procedure for this task.

A. First disable and then re-enable the rule.

This is not the designated procedure. Disabling a rule removes it from the active policy, which can create a temporary security gap, and is not the intended method for resetting a counter.

B. Reboot the data-plane.

Rebooting the data plane is a highly disruptive action that causes a network outage. While it would reset all hit counters, it is not a targeted or appropriate method for a single rule.

D. Type the CLI command reset hitcount .

This command syntax is incorrect. The correct operational command in the CLI to clear a security rule's hit count is clear rule-hit-count security rule , not reset hitcount.

---

1. Palo Alto Networks PAN-OS® Administrator’s Guide 11.0: In the section on managing security policies

the procedure for monitoring rule usage is detailed. It explicitly states the GUI method for resetting counters.

Reference: Chapter: Policies > Security

Section: "Monitor Policy Rule Usage".

Quote/Content: "To reset the hit count for one or more rules

select the rules and then select Hit Count > Reset." This directly validates option C as the correct procedure.

2. Palo Alto Networks PAN-OS® CLI Quick Start 11.0: This guide details the available operational commands. The command for clearing rule hit counts is specified

showing the syntax in the question is incorrect.

Reference: Section: Operational Mode Commands.

Content: The guide lists the command clear rule-hit-count with its various parameters (e.g.

security

nat). This confirms that the command reset hitcount as stated in option D does not exist.