Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking to perform policy audits against firewall configurations and/or rulesets. This should be performed independently of any configuration management systems, ideally by operating off the running config. I am most interested in inspecting Cisco PIX/ASA/FWSM and Juniper NetScreen/JunOS devices, however iptables and WFP are also of interest. What tools or techniques exist for doing this?

share|improve this question
Also see… – AviD May 27 '11 at 12:35
Reopened because of the "independant of...". However there are some good answers at… regardless... – AviD May 28 '11 at 22:08
I recommend a tool called WallParse It can be used freely for 30 days and you can use SQL queries to go through checklists. Nipper Studio is great but quite expensive these days. It has some really good support for many firewall types though which is nice. – user87698 Sep 25 '15 at 19:55
up vote 5 down vote accepted

I'd recommend nipper for this. Runs on a wide range of devices, and is targeted at firewall audits, rather than configuration management.

In my experience it's very easy to get working. Generally, you give it a copy of the config and it runs :)

share|improve this answer
I have only used nipper once, but it was as easy as @RoryM says - and a manual review confirmed it was pretty good. Gets all the stuff you would hope an automated tool could get! – Rory Alsop May 30 '11 at 8:17

Athena Security has a tool that does this kind of analysis.

You didn't mention Checkpoint, but the Checkpoint Users Group (CPUG) has discussions of such tools--many of which are not Checkpoint specific.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.