Firewall Best Practices Audit

Firewall Best-Practices Audit

Overview

Use this skill to audit a firewall or NGFW rulebase for security and operational hygiene, vendor-neutrally, over the parsing-* intermediate JSON schema. The audit reads normalized security_policies, nat_rules, address/service objects and groups, zones, vpn_tunnels, system, and admin_users, then emits prioritized findings across the security and operational check families (full catalog: references/check-catalog.md). Each finding carries a severity, a confidence, the affected references, why it matters, and remediation.

This skill is deliberately framework-agnostic. It answers "is this rulebase hardened by general best practice" — not "does this satisfy PCI/HIPAA/CMMC/CIS/ISO/SOC 2." That mapping is the job of the *-ngfw-compliance skills, which take a framework's control IDs and produce assessor-ready evidence. This skill stays in the lane of general hygiene: it never cites a control ID and never claims an environment is compliant. Use it before or alongside a compliance review, or on its own when someone just wants the rulebase cleaned up and tightened.

The audit reports findings, not verdicts. It never claims a config is "secure" — at best it reports "no in-scope findings" with caveats about what could not be checked (for example, hit-count or last-used data that the static schema does not carry). The output is decision-grade: a short posture line, a severity tally, the list of checks that were skipped for missing data, and a prioritized list of top fixes.

Scope and routing

Operate on the normalized parsing-* schema; do not hand-audit raw vendor text when a parser exists. Route framework mappings to the matching compliance skill, migrations to firewall-config-conversion, and parity or drift comparisons to firewall-config-diff.

Input Handling

Route on what you were given:

• Parsed intermediate schema (the vendor-neutral JSON produced by any parsing-* skill; the schema definition lives in the parsing-srx-configs skill) — audit directly. Read metadata.source_vendor to drive vendor-specific remediation snippets. metadata.source_vendor is the canonical schema field; for robustness also accept a legacy metadata.vendor key if a non-conformant parse provides one — read whichever is present.
• Raw config — identify the vendor from the syntax, run the matching parsing-* skill (parsing-cisco-configs, parsing-fortinet-configs, parsing-palo-configs, parsing-srx-configs) to produce the intermediate schema, then audit the result. Never re-implement parsing in this skill. For a single live device pulled via NETCONF/MCP, parsing-srx-configs permits auditing from the extracted hierarchical sections without full schema emission — still route the extraction through that skill; never hand-parse raw text ad hoc.
• Unsupported vendor with no parser — say so plainly: there is no parser for this vendor, so a structured audit cannot be produced; offer to audit a manually-normalized schema or to reason about pasted excerpts without finding IDs.

As of v1.1 the audit also reads system.ssh, system.auth, system.control_plane_protection, zones[].screen, and security_services to cover device-plane hardening (SSH/management hardening, password/lockout policy, screen presence, and unreferenced security services); any of these fields that is absent simply skips its dependent check.

Graceful degradation: the schema is static, so some checks have no input (for example, anything depending on hit counts or last-used timestamps, and any check needing a field the source parser did not populate). When a field is missing, skip the dependent check rather than guessing, and record every skipped check in the audit summary so the gap is visible.

Severity & Confidence

| Severity | One-line criterion | |----------|--------------------| | Critical | Direct, exploitable exposure — any-any-allow across a trust boundary, dangerous service open to untrust, plaintext admin reachable externally, broken/keyless VPN. | | High | Strong weakness — overly permissive allow, shadowed rules hiding later policy, weak VPN/IKE crypto (DES/3DES/MD5/SHA1/DH] () — Category: / Affected: Why it matters: Remediation: Fix ():

### Audit Summary

```text
Posture: 
Findings: Critical   High   Medium   Low   Info 
Checks skipped (no data): 
Top fixes (prioritized):
  1.  — 
  2.  — 

Common Pitfalls

• Claiming a config is "secure" or "compliant" — only report "no in-scope findings" with caveats about what could not be checked.
• Mapping findings to PCI/HIPAA/etc. — that is the compliance skills' job; stay framework-agnostic and cite no control IDs.
• Re-implementing parsing instead of delegating to the matching parsing-* skill.
• Reporting heuristic findings (possible shadow) as definitive when rule order or object references are incomplete.
• Auditing only the internet edge — include internal, management, VPN, and inter-zone rules.
• Ignoring NAT when reasoning about real exposure — a translated address can change what a rule actually permits.
• Flagging disabled rules as active risk — note them as cleanup, not exposure.
• Treating an unreferenced object as a finding without confirming the schema captured all references.
• Putting real secrets or PSKs in example output — always redact.
• Silently dropping checks when a schema field is missing — list them as skipped in the summary.

Verification Checklist

• [ ] Confirm input type (parsed schema vs raw config) and source vendor.
• [ ] For raw config, the matching parsing-* skill was run first.
• [ ] Every finding has id, severity, confidence, affected refs, rationale, remediation.
• [ ] Remediation includes vendor-neutral guidance + a source-vendor snippet.
• [ ] Heuristic findings are labeled; definitive vs heuristic is correct.
• [ ] Skipped checks (missing schema fields) are listed in the summary.
• [ ] Output makes no "secure"/"compliant" claim and no compliance-framework mapping.
• [ ] No real secrets in any snippet.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: fastrevmd-lab
• Source: fastrevmd-lab/fwskillsshare
• License: Apache-2.0
• Homepage: https://mechub.org

Install and usage instructions live in the source repository linked above.