Firewall Configuration Analysis

[tony_scarola]

Hello! We are looking for a product to provide firewall configuration analysis (not log analysis). Specifically we are interested in generating reports for DSO-type (security officer or auditors) that will be a plain-English version of the firewalls' configuration, in an easy-to-read report. Unfortunately the ASDM does not provide this type of reporting. At present time, I have reviewed some products such as FireGen for PIX, however, this does not do what we wish. What are other people using?

Thank you in advance.

[a.kiprawih]

Try look at these:

Cisco PIX Firewall Analysis Tool

http://www.techzoom.net/down-zoompix.asp

Sample config analysis : http://www.techzoom.net/down-zoompix-sample.asp

Firewall Analyzer

http://manageengine.adventnet.com/products/firewall/index.html

HTH

AK

[tony_scarola]

Unfortunately I cannot seem to download ZoomPIX. Do you have an alternate link?

Also, the Adventnet Firewall analyzer does not analyze static configurations. I have confirmed this with Adventnet.

Thanks,

Tony

[a.kiprawih]

In the Download page, the download button is actually on your right.

http://www.techzoom.net/download-zoompix.asp

Cheers!

AK

[tony_scarola]

Excellent! I was able to download it. Now, can you tell me how to uncompress it? Every time I try I receive file corrupt errors in WinZip. Maybe I need to use a different compression utility?

"error [C:\Documents and Settings\{username}\Desktop\ZoomPIX_10.zip]: start of central directory not found; Zip file corrupt.

Possible cause: file transfer error"

Thanks again!

[a.kiprawih]

It's a single perl script. You need Perl/Active Perl on Win/Linux to run it.

AK

[tony_scarola]

Ok, great. Now THAT ZIP file worked perfectly! (I wonder what is wrong with the ZIP on the website?) Anyway, now I have copied the PL file to the management server (which is a Windows Server 2003 machine with the latest version of Active Perl installed.) When I attempt to run the Perl script (using perl zoompix.pl" I receive the following error:

Can't locate Date/Calc.pm in @INC (@INC contains: c:/Perl/site/lib c:/Perl/lib .

) at c:\zoompix\zoompix.pl line 26.

BEGIN failed--compilation aborted at c:\zoompix\zoompix.pl line 26.

The only calc.pm file that I can find is located at C:\Perl\lib\Math\BigInt.

Any ideas?

Thank you for all of your previous help!

Tony

[tony_scarola]

I figured it out. I was missing the Date-Calc module which I had to first install with "ppm install Date-Calc". It seems to be running now, however, it does not appear to be compatible with the 7.x PIX or ASA firmware code as some of the sections in the report do not function. For example, the reports show all ACLs as being a size of "0 entries" and have Interfaces set to "none". Also, the version is showing up as "%page_pix-version%". The Interfaces section of the report is also blank.

I see that it does work with firmware verion 6.3(4), however, we haven't been on that firmware version since May of 2005. What a shame, it looks like a great application.

Thanks anyway!

[RICH FRUEH]

I know it's an old thread, but is there an updated zoompix for the ASA?  Since techzoom.net doesn't answer, probably not, but thought I'd ask, as it appears to be exactly what was needed.