Free tool · No upload · No sign-up

Firewall Policy Auditor

Drop a FortiGate, Palo Alto or Cisco ASA rulebase export and get a security-posture audit: shadowed and redundant rules, conflicting overlaps, any/any allows, management and risky ports exposed to untrusted zones, missing logging and inspection, unused, disabled and stale rules — each with the affected rules and what to do about it. Analysis runs entirely in your browser: your rulebase never leaves this page.

Feedback Pro is coming →

1 · Vendor

FortiGate Palo Alto Cisco ASA

2 · Rulebase & objects

Drop files here or click to browse — add several at once (rulebase + object exports).
Nothing is uploaded; files are read locally.

…or paste a config / export instead

–posture

Want these findings fixed? IPWOX audits and remediates firewall estates for UK businesses and MSPs — white-label if you're a partner. A 30-minute review of your results costs nothing.

Book a 30-minute review →

Findings

Rulebase

#	Name	From → To	Source	Destination	Service	Action	Log	Hits	Flags

How to read this audit.

Shadowed — an earlier rule already matches everything this rule would, with a different action: the rule never fires. Redundant — fully covered with the same action: a consolidation candidate, not a security hole. Detection here is rule-pair based (the standard Al-Shaer classification); a rule hidden only by a combination of earlier rules won't be flagged.
Conflicting overlap — two rules partially intersect with opposite actions, so behaviour depends on ordering. Review deliberately, don't just reorder.
Zones, addresses and services are resolved from the object exports you provide. Rules that reference objects missing from the exports are audited on what is known and flagged — upload the address/service object CSVs alongside the rulebase for full coverage.
Hit counts (where the export includes them) drive unused/stale findings. Zero hits since first-hit tracking began is strong evidence, but check your tracking window before deleting.
This is a static rulebase review, not a penetration test: NAT, routing, VPN termination and per-rule security profiles all change real exposure.

Built by IPWOX — independent network & security consultancy. 100% client-side: your rulebase is parsed and analysed in this tab and never uploaded. Want a human expert review of the findings? Talk to an engineer. More free tools.

Save your audits — Auditor Pro is coming. Audit history, drift between runs, scheduled re-audits and white-label PDF reports for MSPs. Join the waitlist and we'll email you once, at launch.

Email only — your rulebase stays in your browser, as always.

Related IPWOX tools: Config Sanitizer · Config Compare · Syslog Triage — all free, all run in your browser. See all tools.