[prev in list] [next in list] [prev in thread] [next in thread] 

List:       firewall-wizards
Subject:    Re: [fw-wiz] Recommendations on modeler/change manger for PIX & FWSM
From:       Avishai Wool <avishai.wool () gmail ! com>
Date:       2006-01-25 13:46:42
Message-ID: 8a9b1fe30601250546j32ed9c1h47d73e3348408da4 () mail ! gmail ! com
[Download RAW message or body]

Brian,

If you are willing to try commercial tools, you can try the Firewall Analyzer
  http://www.algosec.com
It handles what you called "modeling" part (what will the firewall do
with this traffic), and also tracks changes to the pix configs, plus an
automatic risk assessment.

Full disclosure: I created this thing from way back when it was
a Bell-Labs research project, so I'm naturally biased.

Cheers,
  Avishai
--
Avishai Wool, Ph.D.,
Chief Technical Officer,       Algorithmic Security Inc.
               http://www.algosec.com
**** Want to audit or debug your firewall's policy? ***


On 1/25/06, Brian Loe <knobdy@gmail.com> wrote:
> > On 1/24/06, Cary, Kim <Kim.Cary@pepperdine.edu> wrote:
> > > Been watching the list with interest for about 6 months! Thanks for the good
> > > discussion.
> > >
> > > We have several PIX & FWSM (PIX Blades) our team is managing. We've been
> > > using PDM (Cisco's Java tool for managing PIX) for distributed
> > > administration, but we've been getting tired of its shortcomings in
> > > documenting our rules. Also, we'd like to find something that handles change
> > > management (reporting, maybe rollback or state snapshots) and modeling (if
> > > traffic from 'here' starts to go 'there' what does the firewall do).
> >
>
> I've implemented a perl script and SVN based solution here for
> managing config changes - archiving/versioning them. Depending on
> where the devices are located in relation to where you run the
> scripts from it can wait to receive a trap stating the config has
> changed or run from a cron job and go grab it. E-mail me off-list and
> I'll give you what I've got.
>
> Can't help with the rest - though you could, in theory, use these
> scripts as a basis for creating new configs to upload programmaticly.
> The perl modules available are pretty robust.
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards@honor.icsalabs.com
> http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
>


--
_______________________________________________
firewall-wizards mailing list
firewall-wizards@honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

[prev in list] [next in list] [prev in thread] [next in thread]