360-FAAR (Firewall Analysis Audit and Repair) is an offline, command line, Perl firewall policy manipulation tool to filter, compare to logs, merge, translate, and output firewall commands for new policies, in Checkpoint dbedit, Cisco ASA, or ScreenOS commands. It is all contained in one file. It can read policy and logs for: Checkpoint FW1 (in odumper.csv / logexport format), Netscreen ScreenOS (in get config / syslog format), and Cisco ASA (show run / syslog format). It uses both inclusive and exclusive CIDR and text filters, permitting you to split large policies into smaller ones for virutalization at the same time as removing unused connectivity. It supports policy to log association, object translation, rulebase reordering and simplification, rule moves, and duplicate matching automatically. It allows you to seamlessly move rules to where you need them. 'print' mode creates a spreadsheet for your audit needs with one command.
|Tags||Firewall Analysis Netscreen CheckPoint Policy Firewall Networking Log Analysis cisco rulebase Monitoring Internet Firewall Analyzer Firewalls cli|
|Operating Systems||Unix Linux Windows OS X|
This release adds "resolve Any" options to 'rr' mode, so that service and network objects found in the logs are used in place of the "Any" objects.
Release Notes: This release adds the "resolve services from 'Any' objects" and the "resolve 'Any' network objects to known nets" option to the 'rr' mode. These new 'rr' mode options require that a log file is loaded and that the output policy is filtered using it. When connectivity is found in the logs which matches a policy instance with the 'Any' service specified, the proto and port or known supernet from the logs are used in the output policy. Resolved objects are reported during the rule build stages and should be added manually.
Release Notes: This release adds the 'hc' option to build rules in 'rr' mode and arrange the most hit new rules at the top. Beware: hit count rules are not 100% reliable at present. Hit counts can be multiplied for multi IP objects. 'cl' mode rules now use the original global rule number instead of incrementing it by 1. The defaults have been changed slightly, and a 'log' defaults option added. This release fixes a bug in 'load' mode trying to load files from '.', and Checkpoint rules that are not logged with a rule number are handled now.
Release Notes: This release adds the 'cl' option to clean/filter original rules, in 'rr' mode, and allows output of service priority rules as well as the original dst src priority rule build. The 'rr' mode menu has been simplified further. Starting the script without any options now starts load mode to add at least one config. This release fixes a bug in the 'any' object matching, any should now be matched from logs. The rashfilter hash tree format has been changed to match the order of the other rule processing hashes: mergebase, filterbase, and rulegroups; this should reduce memory use slightly.
Release Notes: This release adds the 'mergelog' mode to merge binary log entries from one config with another and significantly updates the user interface. All configs can be loaded from the 'load' menu instead of specifying them on the command line. This release adds 'verbose' switches to 'print' and 'rr' modes so that screen output can be switched off, and all 'end.' key words have been changed to simply '.' to reduce the number of keystrokes needed. Entering '0' now adds all options, and '.' chooses the default if available. The netscreen output stage now uses a default zone if none are specified.
Release Notes: This release changes the commandline options and permits you to process as many configurations as you choose. All code has been refactored into subroutines. Three new modes have been added. "load" mode allows you to load new configuration bundles into an already running instance of 360-FAAR, "copylog" mode associates a log file from one configuration with another loaded or new configuration, and "help" mode prints information about all of the other modes. Undefined warnings have been resolved when using CTRL-C to exit the user loop.