See what your firewalls actually allow.
SAMURAI’s Policy Analyzer is a self-hosted firewall policy analyzer. It works out what your rule base really lets through once objects, groups and NAT are resolved, which is often more than the rule text suggests. It finds shadowed, redundant and overly broad rules and ranks every rule by exposure, using the same logic for Palo Alto, Cisco FTD, FortiGate, Juniper SRX and Cisco ACI.
Updated July 2026
What it works out
Effective access
The traffic your rule set permits end to end, with address and service objects expanded and NAT applied. You see what’s really reachable.
Shadowed rules
Rules that can never match because an earlier rule already catches their traffic. They hide intent, and auditors flag them.
Redundant rules
Rules whose effect another rule already covers. You can delete them without changing what the firewall allows.
Overly broad rules
Any-to-any sources, wide CIDR ranges and service “any”, flagged before an auditor finds them.
Risk ranking
Every rule ranked by exposure, so cleaning up 2,000 rules starts with the ten that matter instead of row one.
Same logic across vendors
Palo Alto, Cisco FTD, FortiGate, Juniper SRX and ACI contracts are normalized into one policy model and analyzed the same way.
Policy analysis vs policy management
AlgoSec, Tufin and FireMon are policy-management suites, built for recertification campaigns, approval workflows and change orchestration. The Policy Analyzer does the analysis part, and it lives in a platform that also covers the routers, switches, fabrics and hypervisors around your firewalls.
Analysis
SAMURAI Policy Analyzer
Effective access, shadowed, redundant and overly broad rules, per-rule risk
Policy management suites
Comparable analysis, plus cleanup based on traffic hit counts
Workflows
SAMURAI Policy Analyzer
Not what we do: no recertification campaigns or approval routing
Policy management suites
Their strength: rule lifecycle, approvals, provisioning
Scope
SAMURAI Policy Analyzer
Firewalls plus routers, switches, ACI fabrics, ISE and vCenter
Policy management suites
Firewall policy
Deployment
SAMURAI Policy Analyzer
One self-hosted Docker container, works air-gapped, data in about five minutes
Policy management suites
Appliance or SaaS rollout
If you run recertification campaigns and approval workflows, buy a policy suite. If you need to know what your firewalls actually allow, which rules are dead weight and which are dangerously wide, across vendors and on your own hardware, the Policy Analyzer does that.
Frequently asked questions
Is SAMURAI a firewall rule analyzer?
Yes. The Policy Analyzer checks every rule in the rule base. It flags shadowed, redundant and overly broad rules, works out the effective access each rule grants with objects and NAT resolved, and ranks rules by risk, for Palo Alto, FortiGate, Cisco FTD, Juniper SRX and ACI.
What is a firewall policy analyzer?
A tool that reads firewall configuration (rules, objects, NAT), works out what the rule base actually permits, and points out problems: rules that can never match, rules that duplicate others, and rules that expose more than intended. It works from configuration. Log analyzers work from traffic records.
What is a shadowed firewall rule?
A rule that can never match, because an earlier rule already catches everything it would. Shadowed rules pile up quietly as rule bases grow, hide what someone meant to do, and slow audits down. SAMURAI finds them across the whole rule set.
What is a redundant firewall rule?
A rule whose effect another rule already provides. Deleting it wouldn’t change what the firewall permits or denies. SAMURAI flags these so cleanup becomes a review, not an archaeology project.
What does "effective access" mean?
It’s the traffic a rule base really permits end to end, with address and service objects expanded and NAT applied. A rule that says “web-servers to db-group” doesn’t tell you much until the objects resolve. Effective access gives you the actual IPs, protocols and ports.
Which firewalls does the Policy Analyzer support?
Palo Alto (PAN-OS), Cisco Secure Firewall (FTD), Fortinet FortiGate (FortiOS), Juniper SRX (Junos OS) and Cisco ACI contracts. They’re normalized into one policy model and analyzed with the same logic.
Does it use traffic logs or hit counts?
No. It works only from configuration read over native APIs and SSH, so it finds structural problems (shadowing, redundancy, over-broad rules, risk) without any log retention. What it can’t tell you is that a rule had zero hits in 90 days, because that needs hit counts. The policy suites cover that.
Does SAMURAI do firewall rule recertification?
No. Recertification campaigns, rule-owner sign-off and approval workflows belong to policy-management suites like AlgoSec, Tufin and FireMon. SAMURAI produces the analysis those workflows rely on: effective access, hygiene findings, risk ranking and a change timeline showing who changed what.
Can I try it on my own firewalls for free?
Yes. A free test license ships with the Docker image on Docker Hub, no email needed. Run one container on a VM that can reach your firewalls, and the Policy Analyzer runs against your real rule base.