I need to review firewall rules of a CheckPoint firewall for a customer (with 200+ rules).

I have used FWDoc in the past to extract the rules and convert them to other formats but there was some errors with exclusions. I then analyze them manually to produce an improved version of the rules (usually in OOo Calc) with comments.

I know there are several visualization techniques but they all go down to analyzing the traffic and I want static analysis.

So I was wondering, what process do you follow to analyze firewall rules? What tools do you use (not only for Checkpoint)?


Recently, the guys at matasano have released Flint, a firewall rules checker. It's GPL and runs on sinatra.

alt text http://runplaybook.com/ui/media/images/flint-screen.png

Looks very promising. Although I haven't tried it yet. There's only support for PIX/ASA firewalls, but they will be adding others in the future.


I have installed it and tested it. Installation is very simple. As for the analysis, I fed it with a complex firewall configuration and it took a long time to analyze. Results were mostly correct, but there were parsing errors.

Overall, this is an initial release of a promising tool. And it was what I was looking for with this question in the first place.


Playbook might be what you're looking for. I haven't run it, but it looks interesting.


I spent a considerable amount of time searching for a low to no cost static analyzer last fall.

The closest I found was a university research project called Fireman Which I never tried to get working.

Currently I'm doing a major clean-up and audit by hand, and verifying against historical NMAP scans and log data.

If there's a better way that's cheap and effective, I'd love to hear about it.


I know two tools to analyze fw rules : SkyBox and RedSeal
It's commercial tools.

  • Have you used them? What output do they produce? – chmeee Jun 30 '09 at 10:57
  • I haven't used them myself but skybox can audit rule base on security policy and network topology and report violation – radius Jun 30 '09 at 23:55
  • RedSeal is more than just firewall rules, they do all kinds of stuff to help visualize your network security architecture, including determining if your current access control stance (implemented via firewalls, ACLs, etc.) is complaint with your desired company "policy" (or other standards, such as PCI-DSS, et al). As far as firewall rules go, they can analyze for a bunch of Best Practice checks, in addition to some firewall specific stuff such as unused rules, missing logging, etc. for a variety of different vendors. – Jed Daniels Jul 20 '13 at 19:38

The best solution I have seen is Checkpoint's web visualization tool.

Windows Download Link: https://supportcenter.checkpoint.com/supportcenter/portal/role/supportcenterUser/page/default.psml/media-type/html?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=10708

You can export to HTML for viewing, or XML if you want to do something with the data. It also exports information about the objects in the rules, in case they are super obfuscated.

Have fun! :D

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.