Firewall Rule Audit Tool
Your firewall policy has grown for years. Shadow rules, any/any permits, and stale rules from decommissioned projects are hiding inside it. ConnectMyAssets audits your entire ruleset automatically, finding what's redundant, what's dangerous, and what hasn't been used in months, so you can clean up and stay compliant.
- ✓Shadow rule detection: rules hidden by higher-priority permits
- ✓Permissive rule detection: any/any, overly broad sources and services
- ✓Unused rule detection: zero hit counts over configurable period
- ✓Policy compliance: PCI-DSS, CIS Firewall Benchmark, custom rules
- ✓Multi-vendor: Fortinet, Palo Alto, Cisco ASA/FTD, Check Point, Juniper SRX
- ✓Full audit trail with change history and compliance report export
Your Firewall Policy Is Probably a Security Liability
The average enterprise firewall policy has hundreds to thousands of rules, accumulated over years of projects, team changes, and emergency fixes. Studies consistently show that a significant portion of firewall rules in production environments are either shadowed (never evaluated), overly permissive (too broad), or completely unused. Each of these represents a security risk, a compliance finding, and operational complexity that makes troubleshooting harder. A manual firewall rule review is labor-intensive, error-prone, and typically happens once or twice a year at best. ConnectMyAssets automates the entire analysis continuously, identifying problems before your next external audit does.
Complete Firewall Rule Audit Capabilities
From shadow rule detection to PCI-DSS compliance reporting, everything your security team needs to maintain a clean, auditable firewall policy.
Shadow Rule Detection
Shadow rules are firewall rules that can never be matched because a more general rule above them in the policy already catches all the same traffic. They are a sign of policy bloat, configuration errors, and compliance risk, auditors flag them as evidence of poor firewall hygiene. ConnectMyAssets analyzes your entire ruleset top-down, identifies every rule that is fully shadowed by a higher-priority rule, and shows you exactly which rule is doing the shadowing. The result is a clean list of dead rules you can safely remove to simplify your policy.
Overly Permissive Rule Detection
Rules with source "any", destination "any", or service "any" are a red flag in any security audit. ConnectMyAssets scans your firewall policies for rules that are broader than they should be, catching any-to-any rules, rules with overly wide source ranges (e.g., 0.0.0.0/0), rules that allow all services on specific hosts, and rules that bypass security zones. Each finding is categorized by severity and comes with a suggested remediation: tighten the source, restrict the service, or replace the rule with a more specific one.
Unused Rule Detection
Firewall rules accumulate over time. Engineers add rules for projects, temporary access, or troubleshooting, and forget to remove them. ConnectMyAssets correlates firewall rule configurations with hit counter data to identify rules that have had zero matches over a configurable time window (7, 30, 90 days). These unused rules expand your attack surface and make your policy harder to manage. ConnectMyAssets flags them for review and generates a cleanup candidate list with rule details, last-seen timestamps, and the recommended action.
Policy Compliance Checks
Verify your firewall ruleset against established security standards and internal policies. ConnectMyAssets includes built-in check packs for PCI-DSS (cardholder data environment segmentation, rule review requirements), CIS Firewall Benchmark controls, and NIST SP 800-41 guidelines. You can also define custom compliance rules: "no rule should allow inbound traffic directly to the database VLAN from the internet", "all management access must be restricted to the management subnet", "deny rules must have a log action". Each check produces a PASS/FAIL verdict with evidence.
Multi-Vendor Firewall Support
Analyze rulesets across all the firewalls in your environment regardless of vendor. ConnectMyAssets supports Fortinet FortiGate (FortiOS), Palo Alto Networks (PAN-OS), Cisco ASA and Firepower (FTD), Check Point (GAIA), Juniper SRX (JunOS), and others. Each vendor's ruleset is parsed natively, the platform understands FortiOS policy objects, Palo Alto security zones, Cisco access-control lists, and Check Point network objects. All findings are presented in a unified view so you can compare firewall hygiene across vendors and sites.
Audit Trail & Change Reports
Every rule change is captured, timestamped, and attributed. ConnectMyAssets maintains a complete history of your firewall rulesets over time, so you can see what changed, when it changed, and who made the change. For compliance audits, PCI-DSS requires firewall rule reviews at least every six months, you can export a full audit report showing the current ruleset analysis, a history of rule changes, and the remediation actions taken on previous findings. Reports are available in PDF for audit submissions and CSV for further analysis.
How It Works
Connect Your Firewalls
Add your firewalls to ConnectMyAssets using read-only API credentials or SSH access. The platform supports agentless collection, no software to deploy on the firewall itself. ConnectMyAssets retrieves the full ruleset, policy objects, address groups, and hit counter data from each device. Multi-vendor environments are handled transparently: FortiGate, Palo Alto, Cisco ASA, Check Point, and Juniper SRX are all connected through the same onboarding workflow.
Run Automated Rule Analysis
ConnectMyAssets analyzes your rulesets automatically on a schedule you define, daily, weekly, or triggered by a rule change. The analysis engine checks every rule for shadow conditions, permissiveness, and usage. It applies all compliance policy checks and correlates hit counter data to identify unused rules. Results are available immediately in the dashboard with severity-based filtering. You can drill down to any finding to see the exact rule, its position in the policy, the reason it was flagged, and the recommended action.
Clean, Document & Comply
Act on findings through guided remediation workflows: disable a shadow rule, tighten a permissive source, remove an unused rule, or raise a change ticket in your ITSM. After remediation, re-run the analysis to confirm the issue is resolved. Generate a compliance report for your next PCI-DSS firewall review, your NIS2 assessment, or your internal security audit. The report includes the before-and-after state of your ruleset, evidence of all findings, and a record of remediation actions, everything your auditor needs.
Frequently Asked Questions
Common questions about firewall rule auditing
What is a shadow firewall rule and why is it a problem?
A shadow rule is a firewall rule that can never be matched because a higher-priority rule in the policy already covers all the traffic it would match. For example, if rule 10 allows "any source to any destination on port 443" and rule 50 allows "10.0.0.0/8 to 192.168.1.0/24 on port 443", rule 50 is shadowed, the traffic it was intended to permit is already allowed (or denied) by rule 10 before it can be evaluated. Shadow rules are a problem for three reasons: they indicate poor policy management, they can silently allow or block traffic in unexpected ways, and they signal to auditors that the ruleset is not properly maintained. ConnectMyAssets identifies every shadow rule and shows you which rule is doing the shadowing so you can make an informed decision about whether to remove, reorder, or modify the rules.
How does ConnectMyAssets identify overly permissive firewall rules?
ConnectMyAssets checks each rule against a set of permissiveness criteria: source set to "any" or a very broad CIDR range (e.g., 0.0.0.0/0), destination set to "any", service set to "any" or a very broad port range, and rules that bypass security zone policies. Each check is severity-weighted, an any/any/any rule on an internet-facing firewall is critical, while a broad service range on an internal-only rule might be a warning. The platform also checks for rules that effectively allow access from untrusted zones to sensitive segments like database VLANs or management networks. All findings come with the exact rule text, the specific field that triggered the finding, and a suggestion for remediation.
How does ConnectMyAssets detect unused firewall rules?
ConnectMyAssets collects hit counter data from your firewalls alongside the ruleset configuration. Hit counters track how many packets or sessions each rule has matched. A rule with zero hits over the defined observation period (configurable: 7, 30, 90 days) is flagged as unused. ConnectMyAssets also records the last time the hit counter was non-zero, so you can see whether a rule was used a year ago but has had no traffic since. For rules with no hit counter data (some older platforms), the platform flags them for manual review rather than making an automatic determination. All unused rule candidates are presented with their full rule details so you can make a deliberate cleanup decision.
Does ConnectMyAssets support firewall rule auditing for PCI-DSS compliance?
Yes. PCI-DSS requirement 1 (install and maintain network security controls) specifically requires organizations to review firewall and router rules at least every six months and to justify every rule. ConnectMyAssets automates this review process: it identifies every rule in scope for the cardholder data environment, flags shadow, permissive, and unused rules, and generates a review report with the justification status for each rule. The report is formatted to meet PCI-DSS evidence requirements. The six-month review cadence can be scheduled and automated, with results archived to prove continuous compliance to a QSA.
Which firewall vendors does the audit tool support?
ConnectMyAssets supports all major enterprise firewall platforms: Fortinet FortiGate (FortiOS), Palo Alto Networks (PAN-OS), Cisco ASA, Cisco Firepower Threat Defense (FTD), Check Point (GAIA/R80+), Juniper SRX (JunOS), and F5 BIG-IP advanced firewall module. The platform parses each vendor's native ruleset format, FortiOS policy objects and address groups, Palo Alto security policies and zones, Cisco ACLs and access rules, Check Point network objects and rule bases. New vendors and firmware versions are added regularly based on customer requirements.
How is a firewall rule audit different from a firewall configuration audit?
A firewall configuration audit checks whether the firewall device itself is correctly configured, firmware version, management access controls, logging settings, password policy, SSH and HTTPS settings, and the hardening of the management plane. A firewall rule audit focuses on the security policy: the rules that decide what traffic is allowed or denied. Both are necessary for a complete security assessment. ConnectMyAssets performs both: the network configuration audit covers the device hardening side (SSH version, NTP, SNMP, banners, and similar), while the firewall rule audit covers the traffic policy side (shadow rules, permissive rules, unused rules, and policy compliance). Most compliance frameworks require both.
Clean Up Your Firewall Policy Before Your Next Audit Does
Shadow rules, any/any permits, and years of accumulated stale rules are hiding in your firewall policy. ConnectMyAssets finds them automatically, so your security team can act before an auditor or an attacker does.