# Multi-Vendor Firewall Analyzer (Self-Hosted)

> Self-hosted firewall configuration analyzer for Palo Alto, FortiGate, Cisco FMC, and Juniper SRX: analyze security policies, NAT, objects, and VPN tunnels from device config, not logs, with every change attributed.

Last updated: June 2026

SAMURAI reads firewall configuration and state across vendors and puts it in one searchable place:

- **Security policies, every vendor**: browse and search firewall rules across Palo Alto (PAN-OS), FortiGate (FortiOS), Cisco FMC/FTD, and Juniper SRX (Junos OS) with server-side filtering by zone, address, port, and action.
- **NAT & decryption rules**: NAT rules with address objects resolved to real IPs, plus SSL/TLS decryption policy visibility.
- **Objects, resolved**: address and service objects expanded recursively to the real protocols and ports they map to, so a rule reads "HTTPS (tcp/443)", not an object name.
- **VPNs**: IPSec tunnels, GlobalProtect, and SSL-VPN sessions.
- **Policy Analyzer**: effective access, rule hygiene (shadowed / redundant / overly-broad), and per-rule risk scoring.
- **Change detection**: every configuration change attributed to an admin (commit-correlated on PAN-OS, transaction-grouped on APIC, time-windowed on FortiOS).
- **Path tracing**: hop-by-hop path simulation through firewalls, routers, switches, and ACI fabrics.

This is a configuration and policy analyzer, not a traffic-log analyzer.

## SAMURAI vs policy management suites

| | SAMURAI | Policy management suites |
|---|---|---|
| Scope | Firewalls plus routers, switches, ACI fabrics, ISE, and vCenter in one view | Firewall-centric policy management |
| Deployment | Single Docker container, self-hosted, air-gap friendly, serving data in about five minutes | Enterprise appliance or SaaS rollout |
| Change visibility | Cross-vendor change timeline with admin attribution | Firewall policy change workflows |
| Policy analysis | Effective access, shadowed/redundant/overly-broad detection, and per-rule risk scoring | Their core strength: recertification, approvals, and orchestration workflows |

## Frequently asked questions

### What is a firewall configuration analyzer?

A firewall configuration analyzer reads firewall configuration (security policies, NAT, objects, VPNs) directly from the device and makes it searchable, comparable, and auditable, instead of parsing traffic logs. SAMURAI is a multi-vendor firewall configuration analyzer for Palo Alto, FortiGate, Cisco FMC/FTD, and Juniper SRX: it shows the rules as they are, resolves objects to real protocols and ports, computes effective access, and attributes every change to an admin.

### Which firewalls does SAMURAI support?

Palo Alto Networks (PAN-OS), Fortinet FortiGate (FortiOS), Cisco Secure Firewall (FMC/FTD), and Juniper SRX (Junos OS), plus ACL visibility on Cisco routers and switches.

### Is SAMURAI a firewall log analyzer?

No, SAMURAI is a firewall configuration analyzer, not a log analyzer. It reads policy and configuration state directly from each device rather than parsing syslog or traffic logs, so you analyze the rules themselves and every change to them. SAMURAI can forward its own events as RFC5424 syslog, but firewall log analytics is not its focus.

### Is there a free firewall analyzer option?

Yes. A free test license ships with the SAMURAI Docker image on Docker Hub, no email required, so you can analyze your own firewalls before talking to anyone. Production use is licensed per deployment, sized by device count.

### Is SAMURAI an alternative to AlgoSec Firewall Analyzer?

For multi-vendor policy visibility, effective-access and rule-hygiene analysis, change tracking, and audit trails: yes. For automated rule recertification and approval workflows, AlgoSec remains the specialist. Many teams want day-to-day visibility across the whole network, and that is what SAMURAI does.

### Is there a FortiGate firewall analyzer in SAMURAI?

Yes. SAMURAI reads FortiGate over the FortiOS REST API: security policies, NAT, address and service objects (resolved recursively), routes, VPN tunnels, and configuration changes, in the same dashboard as your Palo Alto and Cisco FMC estate.

### Does SAMURAI analyze Cisco firewalls?

Yes. Cisco Secure Firewall (FMC/FTD) access and NAT policies, objects, and deployable devices are first-class, alongside ACL visibility on Cisco routers, switches, and ACI fabrics.

### Can SAMURAI run air-gapped?

Yes. It ships as a self-contained Docker image with an offline IEEE OUI database and no telemetry. Nothing leaves your perimeter.

### How do I deploy it?

A single docker run. The image is published on Docker Hub; a typical deployment is serving data in about five minutes.

---

Canonical page: https://nometa.az/en/firewall-analyzer/
Part of SAMURAI, a self-hosted, multi-vendor network monitoring & security platform. Overview: https://nometa.az/llms.txt
Contact: info@nometa.az · Docker Hub: https://hub.docker.com/r/beyrak44/samurai