Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking for a solution to be able to distribute and sync firewall rule-sets to multiple devices. There are a few solutions out there such as Playbook by Matasano but it comes with an expensive price tag.

Is anyone familiar with any other solutions that are cheaper or ideally free and allow for the syncing of Cisco and iptables rule-sets?

share|improve this question

A couple engineers I know are using puppet to maintain iptables rule sets.

share|improve this answer
Puppet looks really interesting. Going to give it a go next week. – Mark Davidson Nov 27 '10 at 20:19
I'm one of those 'engineers'. I use the first method, and it works great. I have on my list testing the second. – Scott Pack Dec 11 '10 at 4:40

Most enterprise class firewalls (I know Check Point and MS ISA, I'm sure others too - but not iptables) allow you to distribute rulesets etc to all the managed firewalls, from a single management console.

Of course, thats each for a single vendor's product... For different types of firewalls, I'm familiar with Tufin, but I think they're pretty high-end - and expensive.

share|improve this answer

FWbuilder might be of interest to you

This is a GUI tool to help you configure and distribute (i.e. push) firewall configurations for various firewall implementations.

It 'compiles' network access rules and firewall configuration options into version specific syntax and can push it through SSH to many firewall implementations like Cisco ACL's, iptables, and openbsd PF.

Central management of various devices in combination with version control of the rulesets of these nodes is a production quality feature that can also be seen in enterprise firewall management applications.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.