# Firewall Policy Analyzer · Effective Access & Rule Hygiene

> Find shadowed, redundant, and overly broad firewall rules, compute effective access with objects and NAT resolved, and risk-score every rule across Palo Alto, FortiGate, Cisco FTD, Juniper SRX, and ACI. Self-hosted.

Last updated: July 2026

The SAMURAI Policy Analyzer resolves the effective permitted space across your rule base: not what a rule says, but what traffic really gets through once objects, groups, and NAT are resolved. Configuration analysis on real device data, not traffic logs.

- **Effective access**: end-to-end permitted space computed across the whole rule set, with address and service objects expanded recursively and NAT resolved.
- **Shadowed rule detection**: rules that can never match because an earlier rule already covers their traffic.
- **Redundant rule detection**: rules whose effect is already delivered by another rule.
- **Overly broad rule detection**: any-any sources, wide CIDR ranges, and service "any" entries flagged automatically.
- **Per-rule risk scoring**: every rule ranked by exposure, so a 2,000-rule cleanup starts with the rules that matter.
- **One model across vendors**: Palo Alto, Cisco FTD, FortiGate, Juniper SRX, and ACI contracts normalized into a canonical policy view.

## Policy analysis vs policy management

| | SAMURAI Policy Analyzer | Policy management suites |
|---|---|---|
| Analysis | Effective access, shadowed/redundant/overly-broad detection, per-rule risk scoring | Comparable analysis, plus usage-based cleanup from traffic hit counts |
| Workflows | Not our focus: no recertification campaigns or approval orchestration | Their core strength: rule lifecycle, approvals, provisioning |
| Scope | Firewalls plus routers, switches, ACI fabrics, ISE, and vCenter in one view | Firewall-centric |
| Deployment | Single self-hosted Docker container, air-gap friendly, serving data in about five minutes | Enterprise appliance or SaaS rollout |

## Frequently asked questions

### What is a firewall policy analyzer?

A firewall policy analyzer reads firewall configuration (rules, objects, NAT) and computes what the rule base actually permits, then flags problems: shadowed rules that can never match, redundant rules that duplicate others, and overly broad rules that expose more than intended. It works from configuration state, unlike log analyzers, which work from traffic records.

### What is a shadowed firewall rule?

A shadowed rule is one that can never match traffic because an earlier rule in the evaluation order already matches everything the shadowed rule would. Shadowed rules are dead configuration: they hide intent, confuse audits, and accumulate silently as rule bases grow. SAMURAI detects them automatically across the whole rule set.

### What is a redundant firewall rule?

A redundant rule duplicates the effect of another rule: removing it would not change what the firewall permits or denies. Redundant rules bloat the rule base and make every audit slower.

### What does "effective access" mean?

Effective access is the set of traffic a rule base really permits end to end, computed with address and service objects expanded recursively and NAT resolved. A rule that says "web-servers to db-group" tells you nothing until the objects resolve; effective access tells you the actual IPs, protocols, and ports that get through.

### Which firewalls does the Policy Analyzer support?

Palo Alto Networks (PAN-OS), Cisco Secure Firewall (FTD), Fortinet FortiGate (FortiOS), Juniper SRX (Junos OS), and Cisco ACI contracts, all normalized into one canonical policy model and analyzed with the same logic.

### Does it use traffic logs or hit counts?

No. The Policy Analyzer works entirely from configuration state read over native APIs and SSH. It finds structural problems (shadowing, redundancy, over-breadth, risk) without needing log retention. It does not do usage-based cleanup ("this rule had zero hits in 90 days"), which requires traffic hit counts; dedicated policy suites cover that.

### Does SAMURAI do firewall rule recertification?

No. Recertification campaigns, rule-owner attestation, and approval workflows are the domain of policy-management suites like AlgoSec, Tufin, and FireMon. SAMURAI gives you the analysis those workflows consume: effective access, hygiene findings, risk ranking, and a change timeline with admin attribution.

### Can I try it on my own firewalls for free?

Yes. A free test license ships with the SAMURAI Docker image on Docker Hub, no email required. One docker run on a VM that can reach your firewalls, and the Policy Analyzer runs against your real rule base.

---

Canonical page: https://nometa.az/en/policy-analyzer/
Part of SAMURAI, a self-hosted, multi-vendor network monitoring & security platform. Overview: https://nometa.az/llms.txt
Contact: info@nometa.az · Docker Hub: https://hub.docker.com/r/beyrak44/samurai