Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm looking to perform policy audits against firewall configurations and/or rulesets. This should be performed independently of any configuration management systems, ideally by operating off the running config. I am most interested in inspecting Cisco PIX/ASA/FWSM and Juniper NetScreen/JunOS devices, however iptables and WFP are also of interest. What tools or techniques exist for doing this?

share|improve this question
    
Also see security.stackexchange.com/questions/1982/… –  AviD May 27 '11 at 12:35
    
Reopened because of the "independant of...". However there are some good answers at security.stackexchange.com/questions/2157/… regardless... –  AviD May 28 '11 at 22:08

2 Answers 2

up vote 5 down vote accepted

I'd recommend nipper for this. Runs on a wide range of devices, and is targeted at firewall audits, rather than configuration management.

In my experience it's very easy to get working. Generally, you give it a copy of the config and it runs :)

share|improve this answer
    
I have only used nipper once, but it was as easy as @RoryM says - and a manual review confirmed it was pretty good. Gets all the stuff you would hope an automated tool could get! –  Rory Alsop May 30 '11 at 8:17

Athena Security has a tool that does this kind of analysis.

You didn't mention Checkpoint, but the Checkpoint Users Group (CPUG) has discussions of such tools--many of which are not Checkpoint specific.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.