Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there any Firewall ACL management tool which can generate set of ACLs for all my network, including switches, checkpoint, cisco routers, windows, linux etc? I think such tool would make sense as this way the network ACL can be controlled from the single point as well firewall rules are basically the same on each device, it's either normal hardware filtering or stateful packet inspection sometimes also with hardware support. Such tool would require to define all devices, interfaces (like vlans), services and protocols, and then by starting with deny all rule, I could just add what is required, generate the files and upload them. For example, I have to publish a new service, so I need to update firewall on core router, switch and the servers and give access via checkpoint as well. When I click on the rule, it shows me all people who have access etc. I dont think such tool would be a problem because generating firewall ACL policy in unified way is very easy.

share|improve this question

closed as off-topic by masegaloeh, mdpc, EEAA, Andrew Schulman, HBruijn Mar 12 at 12:18

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

up vote 3 down vote accepted

Take a look at Google's Capirca ACL generator. As of today, they support Cisco IOS, Cisco ASA, JunOS, Juniper SRX, and iptables. They claim Capirca is easily extensible to other platforms, but I have never done it myself.

They have an Example ACL Policy file that gives you a basic idea of how they structure the engine.

Also check out their demonstration video

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.