Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there any Firewall ACL management tool which can generate set of ACLs for all my network, including switches, checkpoint, cisco routers, windows, linux etc? I think such tool would make sense as this way the network ACL can be controlled from the single point as well firewall rules are basically the same on each device, it's either normal hardware filtering or stateful packet inspection sometimes also with hardware support. Such tool would require to define all devices, interfaces (like vlans), services and protocols, and then by starting with deny all rule, I could just add what is required, generate the files and upload them. For example, I have to publish a new service, so I need to update firewall on core router, switch and the servers and give access via checkpoint as well. When I click on the rule, it shows me all people who have access etc. I dont think such tool would be a problem because generating firewall ACL policy in unified way is very easy.

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Take a look at Google's Capirca ACL generator. As of today, they support Cisco IOS, Cisco ASA, JunOS, Juniper SRX, and iptables. They claim Capirca is easily extensible to other platforms, but I have never done it myself.

They have an Example ACL Policy file that gives you a basic idea of how they structure the engine.

Also check out their demonstration video

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.