Self-hosted firewall management that stays inside your network.
SAMURAI is self-hosted firewall management software for mixed-vendor estates. It reads security policies, NAT, objects, VPNs and configuration changes from Palo Alto, FortiGate, Cisco FMC/FTD and Juniper SRX, and runs entirely on a VM you own. There’s no cloud tenant and no telemetry, so it works for teams whose firewall configuration isn’t allowed to leave the building.
Updated July 2026
What self-hosting gets you
Configs stay on your VM
Policies, objects and device credentials live on your VM. No vendor cloud ever ingests your rule base.
No telemetry at all
No usage analytics, no license heartbeat, no crash reports. The only connections it makes are to the devices you add.
Works air-gapped
It runs fully offline with a built-in IEEE OUI database and no external calls, so an isolated network gets the same install as any other.
One container
The whole platform is one container on one VM. No Kubernetes, no managed service, no per-seat subscription.
All your firewalls together
Palo Alto, FortiGate, Cisco FMC/FTD/ASA and Juniper SRX policies in one search, next to the routers, switches, ACI fabrics, ISE and vCenter around them.
Read-only
It runs show commands over SSH and read calls against vendor APIs. SAMURAI never pushes configuration, so it can’t break anything.
Self-hosted vs SaaS policy tools
A lot of firewall policy tools now run in the vendor’s cloud. That works until someone on the security team asks where the configuration goes, or until the network has no internet at all. SAMURAI is built for those cases.
Where your config lives
SAMURAI (self-hosted)
On your VM, inside your network
SaaS policy tools
In the vendor’s cloud
Telemetry
SAMURAI (self-hosted)
None
SaaS policy tools
Usage and license telemetry, usually on by default
Air-gapped networks
SAMURAI (self-hosted)
Supported, and it works fully offline
SaaS policy tools
Usually unsupported
Deployment
SAMURAI (self-hosted)
One Docker container, data in minutes
SaaS policy tools
Cloud tenant onboarding or an appliance rollout
If a cloud-managed policy suite fits your risk model, it may be the easier route. If your firewall configuration can’t leave your network, self-hosting isn’t a preference. It’s the requirement SAMURAI was built around.
Frequently asked questions
What is self-hosted firewall management?
Running the management and analysis software on infrastructure you control instead of in a vendor’s cloud. Your firewall configuration, objects and credentials stay on your network. SAMURAI is built that way: one Docker container on your own VM, with no cloud tenant and no telemetry.
Does any data leave my network?
No. There’s no telemetry and no license heartbeat. SAMURAI reads from your devices over their APIs and SSH, stores everything locally, and only connects to the devices you register.
Can it run without internet access?
Yes. It ships with a built-in IEEE OUI database and needs no external services, so it runs fully air-gapped. The air-gapped network security page has the details.
Which firewalls does it manage?
Palo Alto (PAN-OS), FortiGate (FortiOS), Cisco FMC/FTD and ASA, and Juniper SRX (Junos OS), plus the ACLs on Cisco routers, switches and ACI fabrics. “Manage” here means read, search, analyze and track changes. SAMURAI is read-only and never pushes configuration.
Is it an on-premise AlgoSec or Tufin alternative?
For multi-vendor visibility, effective access, rule hygiene and change attribution, yes, and it runs entirely on your own infrastructure. For recertification and provisioning workflows, AlgoSec and Tufin remain the specialists.
How is it deployed and licensed?
One container on one VM, usually serving data within five minutes. The free test license ships with the image, no email needed. Production licenses are per deployment and priced by device count.