Measure cloud firewall policy hygiene: quota headroom, shadowed and duplicate rules, any-any exposure and effective rule count per policy.
Firewall policies are evaluated in priority order, so a rule that nothing has matched in ninety days is either dead or a latent hole, and a rule matching any source and any destination makes everything beneath it unreachable. The score penalises dead rules proportionally, any-any rules absolutely, and quota pressure only once you pass 80% — the point at which a routine change starts failing. Nobody deletes firewall rules, so policies grow until a change fails at 3am on the quota limit, and by then the any-any rule somebody added 'temporarily' during a migration has been the effective policy for two years.
Cloud Firewall Rule
Hygiene = 100 − 2 × dead-rule percentage − 4 × any-any rule count − quota overshoot above 80%, clamped to 0–100. Dead rules = shadowed + duplicate.
Effective rule count
Effective rules = total rules − shadowed − duplicate: the count that actually decides whether a packet passes.
Hygiene = 100 − 2 × dead-rule percentage − 4 × any-any rule count − quota overshoot above 80%, clamped to 0–100. Dead rules = shadowed + duplicate. Firewall policies are evaluated in priority order, so a rule that nothing has matched in ninety days is either dead or a latent hole, and a rule matching any source and any destination makes everything beneath it unreachable. The score penalises dead rules proportionally, any-any rules absolutely, and quota pressure only once you pass 80% — the point at which a routine change starts failing.
Nobody deletes firewall rules, so policies grow until a change fails at 3am on the quota limit, and by then the any-any rule somebody added 'temporarily' during a migration has been the effective policy for two years.
This calculator takes 9 inputs: Rules in the policy, Rules per policy limit, Allow rules, Deny rules, Rules with any source and any destination, Rules never matched in 90 days, Duplicate or fully overlapping rules, Free priority slots between rules, Rule evaluations per day. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
A higher-priority rule already covers its entire match space, so it can never fire. Shadowed rules are dangerous during clean-up: deleting the higher-priority rule silently activates the shadowed one, and if that one is broader you have just opened a hole while doing hygiene work.
Azure NSG priorities run 100 to 4096 and evaluation is strictly ordered, so inserting a deny above an existing allow needs a free number between them. Policies numbered 100, 101, 102 have to be fully renumbered to insert anything, which is a change-window-sized problem rather than a five-minute one.