ACL and Firewall Rule Analysis

Vendor-agnostic rule analysis for access control lists and firewall policies. Unlike vendor-specific firewall audit skills that evaluate platform features (App-ID, Security Profile Groups, zone protection), this skill focuses on universal rule patterns that apply across all platforms: shadowed rules, redundant rules, overly permissive rules, and unused rules.

Covers ACL-based platforms (Cisco IOS/IOS-XE/ASA, Juniper JunOS, Arista EOS) and policy-based firewalls (Palo Alto PAN-OS, Fortinet FortiGate, Check Point). The analysis algorithms are vendor-agnostic, only the rule retrieval commands differ by platform.

Commands use inline labels [Cisco], [JunOS], [EOS], [PAN-OS], [FortiGate], [CheckPoint] where syntax diverges. Unlabeled statements apply universally. See references/cli-reference.md for full command tables and references/rule-patterns.md for detection algorithm details.

When to Use

• Post-migration rule cleanup after converting from one platform to another
• Periodic rulebase hygiene to remove accumulated technical debt
• Compliance preparation requiring rule-level justification and minimal privilege
• Incident investigation, determining whether a rule permitted malicious traffic
• Change validation after rulebase modifications to confirm no shadowed rules
• Capacity optimization, reducing rule count to improve lookup performance
• Merger/acquisition integration, consolidating overlapping rulebases

Prerequisites