Firewall rules baseline

Question

Is there a tool which I can use to monitor network traffic so that I can determine firewall rules and implement them on an existing network?

Answer 1

Well, sounds like you just need to get a good read on what sort of traffic is crossing your network. For that, set up a mirrored port on one of your switches, connect a PC to it, and fire up Wireshark. After getting a packet capture, you'll be able to very easily see what's going on.

When doing this sort of work, I typically start from a "deny all" perspective. Assume that you're going to block everything, and then make a list of what applications need to be accessible through the firewall, and what allow rules you'll need for each of them.