Firewall policy review
Review firewall policy intent, effective access, ownership and observed use before making bounded cleanup or risk-reduction changes.
What we review
- Rule intent and match criteria: Names, descriptions, owners, source and destination zones, addresses, users, applications, services, schedules and actions.
- Rule order and effective policy: Shadowing, broad earlier matches, pre-rules and post-rules, local overrides and interactions that change the apparent result.
- Objects and groups: Unused, duplicate, nested, misleading or overly broad objects, including dynamic membership and external lists where used.
- Observed use and stale access: Hit counts, log history, application visibility, expired temporary rules, disabled entries and access with no confirmed owner.
- Inspection and threat prevention: Security profiles, decryption assumptions, application controls, URL or DNS controls, file handling and exceptions that reduce inspection.
- Logging and operational evidence: Session logging, forwarding, retention, time accuracy, rule identifiers and the information available during troubleshooting or incident response.
- Administration and change controls: Administrative access, role separation, configuration backup, candidate review, commit controls, high availability and rollback readiness.
- NAT and related dependencies: Translation rules, proxy or load-balancer dependencies, route assumptions and return paths where they affect reviewed policy.
Deliverables
- Policy inventory and review record: Platforms, devices, virtual systems, policy layers, rule counts, evidence period and exclusions.
- Rule-level findings: Evidence tied to rule UUID or stable identifier, current match criteria, observed use, owner status, risk and recommended action.
- Object and dependency findings: Affected groups, NAT, routes, profiles and shared policy relationships that must be understood before a rule changes.
- Prioritized remediation backlog: Candidate actions grouped into urgent exposure, low-risk housekeeping, owner validation and design work.
- Change packages: Where included, bounded candidate changes with prechecks, validation, monitoring, stop conditions and rollback.
- Review playbook: A repeatable method for policy ownership, temporary access, evidence retention and periodic review.
Engagement boundaries
- A policy review can identify risk and cleanup candidates, but traffic evidence is never complete by default. Business cycles, disaster procedures and rarely used administrative paths may not appear during the review period.
- Included: Read-only review of the agreed policy, configuration and available logs.
- Included: Validation with service owners where ownership can be established.
- Included: Specific findings tied to stable configuration identifiers.
- Included: Safe remediation and rollback planning for accepted recommendations.
- Not included: Automatic deletion of unused rules or objects based only on hit counts.
- Not included: Production commits without separate authorization, named operators and an approved change window.
- Not included: A guarantee that all permitted traffic, threats or hidden dependencies have been identified.
- Not included: Review of routers, load balancers, endpoint controls or cloud security policy except where explicitly included.
Questions before the work starts
Which firewall platforms can be reviewed?
The method applies across enterprise firewall platforms, with platform-specific evidence and controls confirmed during scoping. Share the vendor, software release, management model and approximate policy size so the review can be sized correctly.
Can you tell us which rules are safe to delete?
The review can identify strong candidates and the evidence needed for a decision. A zero hit count alone is not enough. Ownership, observation period, seasonal use, emergency procedures and dependencies are checked before removal is recommended.
Do you need administrative access?
Read-only platform access is usually the most reliable option. Secure exports may be sufficient for a narrower review. Credentials and sensitive configuration should be exchanged through an agreed secure method, not ordinary email.
Can the review support a firewall migration?
Yes. The review can separate policy that should be migrated from stale or platform-specific configuration. Migration design, rule conversion, testing and cutover support are scoped according to the source and target platforms.
Will changes be made during the review?
Not by default. Review and production implementation are separate control points. If change support is included, each package has an approved boundary, validation plan and rollback action.
The platforms this work covers
Policy review works directly against the firewall platform in place, using its own configuration and logs.
- Palo Alto Networks and Panorama
- Fortinet FortiGate and FortiManager
- Check Point
- Cisco ASA and Firepower
- Azure Firewall and network security groups
- AWS security groups and network ACLs
Audits available
- Firewall policy audit: rule intent, effective access, shadowed and unused rules, ownership and expiry, per platform.
Other ways we can help
Engagements are often scoped together; these are the closest neighbours to this one.
Need to reduce firewall policy risk without breaking required access?
Share the platform, approximate policy scope, management model and reason for the review. If a migration or audit date is driving the work, include that deadline.