12

I need to review firewall rules of a CheckPoint firewall for a customer (with 200+ rules).

I have used FWDoc in the past to extract the rules and convert them to other formats but there was some errors with exclusions. I then analyze them manually to produce an improved version of the rules (usually in OOo Calc) with comments.

I know there are several visualization techniques but they all go down to analyzing the traffic and I want static analysis.

So I was wondering, what process do you follow to analyze firewall rules? What tools do you use (not only for Checkpoint)?

Improve this question

5 Answers 5

Reset to default
4

Recently, the guys at matasano have released Flint, a firewall rules checker. It's GPL and runs on sinatra.

alt text
(source: runplaybook.com)

Looks very promising. Although I haven't tried it yet. There's only support for PIX/ASA firewalls, but they will be adding others in the future.

EDIT:

I have installed it and tested it. Installation is very simple. As for the analysis, I fed it with a complex firewall configuration and it took a long time to analyze. Results were mostly correct, but there were parsing errors.

Overall, this is an initial release of a promising tool. And it was what I was looking for with this question in the first place.

Improve this answer
1

Playbook might be what you're looking for. I haven't run it, but it looks interesting.

Improve this answer
1

I spent a considerable amount of time searching for a low to no cost static analyzer last fall.

The closest I found was a university research project called Fireman Which I never tried to get working.

Currently I'm doing a major clean-up and audit by hand, and verifying against historical NMAP scans and log data.

If there's a better way that's cheap and effective, I'd love to hear about it.

Improve this answer
0

I know two tools to analyze fw rules : SkyBox and RedSeal
It's commercial tools.

Improve this answer
3
  • Have you used them? What output do they produce?
    – chmeee
    Jun 30, 2009 at 10:57
  • I haven't used them myself but skybox can audit rule base on security policy and network topology and report violation
    – radius
    Jun 30, 2009 at 23:55
  • RedSeal is more than just firewall rules, they do all kinds of stuff to help visualize your network security architecture, including determining if your current access control stance (implemented via firewalls, ACLs, etc.) is complaint with your desired company "policy" (or other standards, such as PCI-DSS, et al). As far as firewall rules go, they can analyze for a bunch of Best Practice checks, in addition to some firewall specific stuff such as unused rules, missing logging, etc. for a variety of different vendors.
    – Jed Daniels
    Jul 20, 2013 at 19:38
0

The best solution I have seen is Checkpoint's web visualization tool.

Windows Download Link: https://supportcenter.checkpoint.com/supportcenter/portal/role/supportcenterUser/page/default.psml/media-type/html?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=10708

You can export to HTML for viewing, or XML if you want to do something with the data. It also exports information about the objects in the rules, in case they are super obfuscated.

Have fun! :D

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .