ACL and Firewall Rule Analysis

ACL and Firewall Rule Analysis

Vendor-agnostic rule analysis for access control lists and firewall policies. Unlike vendor-specific firewall audit skills that evaluate platform features (App-ID, Security Profile Groups, zone protection), this skill focuses on universal rule patterns that apply across all platforms: shadowed rules, redundant rules, overly permissive rules, and unused rules.

Covers ACL-based platforms (Cisco IOS/IOS-XE/ASA, Juniper JunOS, Arista EOS) and policy-based firewalls (Palo Alto PAN-OS, Fortinet FortiGate, Check Point). The analysis algorithms are vendor-agnostic — only the rule retrieval commands differ by platform.

Commands use inline labels [Cisco], [JunOS], [EOS], [PAN-OS], [FortiGate], [CheckPoint] where syntax diverges. Unlabeled statements apply universally. See references/cli-reference.md for full command tables and references/rule-patterns.md for detection algorithm details.

When to Use

• Post-migration rule cleanup after converting from one platform to another
• Periodic rulebase hygiene to remove accumulated technical debt
• Compliance preparation requiring rule-level justification and minimal privilege
• Incident investigation — determining whether a rule permitted malicious traffic
• Change validation after rulebase modifications to confirm no shadowed rules
• Capacity optimization — reducing rule count to improve lookup performance
• Merger/acquisition integration — consolidating overlapping rulebases

Prerequisites

• Read-only access to the target device via SSH, console, or API
• Rulebase with hit counters enabled (most platforms enable by default)
• For unused rule detection: hit count data accumulated over an extended period (30+ days minimum, 90 days recommended for seasonal traffic patterns)
• Knowledge of intended security policy — which traffic should be permitted and which should be denied between network segments
• Understanding of implicit deny behavior for the platform (varies — see Troubleshooting)

Procedure