Firewall Management
Your firewall rules have secrets, rules that never matched in years, duplicates, shadow rules giving a false sense of control. ConnectMyAssets finds them all.
- ✓Shadow rule detection across all vendors
- ✓Redundant and unused object cleanup
- ✓Cross-vendor unified rule view
- ✓Per-rule compliance scoring (AND/OR logic)
- ✓Normalized export for audit documentation
Visibility and Hygiene Across All Vendors
One unified view of all your firewall policies, normalized from every vendor's proprietary syntax into clear, readable findings you can act on.
Shadow Rules
Rules never triggered because blocked by a preceding rule. Find and remove them.
Redundant Rules
Duplicate rules cluttering your policy. Automatically identified.
Unused Objects
Address groups, service objects never referenced. Clean your base.
Cross-Vendor View
Checkpoint, Fortinet, Palo Alto, Cisco ASA, Juniper in one unified interface. Business intent, not vendor syntax.
Per-Rule Compliance
Built-in rule library plus custom policy builder. AND/OR conditional logic compliance check per individual rule.
Normalized Export
Export all rules in a standardized format, regardless of vendor.
How It Works
From raw vendor policies to normalized, analyzed, and clean firewall rules, in four steps.
Connect All Firewalls
Add Checkpoint, Fortinet, Palo Alto, Cisco ASA, Juniper, or F5 devices. Firewall rules, NAT rules, objects, and associated metadata are collected via vendor-native methods, CLI, API, or other vendor-specific protocols depending on the platform.
Normalize to Unified Model
Rules are translated into a vendor-neutral format. Source, destination, service, action, universal fields.
Analyze for Hygiene Issues
Shadow rules, redundant rules, and unused objects are flagged automatically with severity scoring.
Remediate and Export
Review findings, apply remediations, and export a clean normalized ruleset for documentation.
Shadow Rules: The Hidden Dead Weight
A shadow rule is one that can never be hit because a more general rule above it already matches all the same traffic. It gives a false sense of control, and inflates your ruleset. ConnectMyAssets flags every shadow rule automatically.
- ✓Detected across all vendor syntaxes
- ✓Severity score based on how long the rule has been inactive
- ✓One-click mark for removal review
- ✓Full audit log if the rule is deleted
"A unified view of all your firewall policies, regardless of vendor, the business intent behind the syntax."
ConnectMyAssets translates vendor-specific rule languages into business-readable intent: who can talk to whom, on what service, and why.
Compliance at the Rule Level
ConnectMyAssets doesn't just check device-level compliance. It evaluates every individual firewall rule against your compliance policies using AND/OR conditional logic. Start from the built-in rule library covering common security best practices, or build your own custom policies using the policy builder.
Multi-condition rules with nested boolean expressions per firewall rule
Weighted compliance score calculated independently per rule, not just per device
Export per-rule compliance evidence as PDF/CSV for your security auditor
Frequently Asked Questions
Common questions about firewall management and policy analysis
What is a shadow firewall rule?
A shadow rule is a firewall rule that can never be matched because a more general rule earlier in the policy already intercepts all the same traffic. Shadow rules give a false sense of security, inflate your ruleset, and are impossible to spot manually in large policies. ConnectMyAssets detects them automatically across all vendor syntaxes.
Which firewall vendors does ConnectMyAssets support?
ConnectMyAssets supports Checkpoint, Fortinet FortiGate, Palo Alto Networks, Cisco ASA, Juniper, and F5 in a unified cross-vendor view. Firewall rules, NAT rules, objects, and associated metadata are collected via vendor-native methods: the exact collection mechanism depends on the vendor and may use CLI, API, or other vendor-specific protocols. Data is then normalized into a vendor-neutral model so you can analyze and compare rules regardless of which platform they come from.
How does per-rule compliance scoring work?
Unlike tools that only score at the device level, ConnectMyAssets evaluates each individual firewall rule against your compliance policies. ConnectMyAssets ships with a built-in rule library covering common security best practices. You can also create your own custom policies using the policy builder. Rules are scored using AND/OR conditional logic, so you can express complex conditions such as "rule must have logging enabled AND source must not be any". Each rule gets an independent compliance score, and findings can be exported for auditors.
Can I detect unused objects and address groups?
Yes. ConnectMyAssets scans your firewall object library and flags address groups, service objects, and schedule objects that are never referenced by any active rule. Cleaning up unused objects reduces policy complexity and removes potential attack surface from stale definitions that may have been created for rules long since deleted.
Can I export firewall rules in a normalized format?
Yes. All firewall rules across all connected vendors can be exported in a standardized format, regardless of their original vendor syntax. This normalized export is useful for audit documentation, change management, cross-vendor comparison, and feeding into external security tools or ticketing systems.
How do redundant rules differ from shadow rules?
Shadow rules are rules that can never fire because another rule above them already matches the same traffic. Redundant rules are exact or near-exact duplicates that exist multiple times in the policy, meaning the same allow or deny is defined more than once. Both types waste policy space and create confusion. ConnectMyAssets detects and flags both categories independently.
Clean Firewalls. Unified View. Full Control.
Stop managing Checkpoint, Fortinet, and Palo Alto in isolation. Bring them together.