Find the risky rules before an attacker or auditor does.
Paste a config from 12 firewall platforms — or your switches, Wi-Fi, NAC, Azure NSG, Citrix NetScaler and F5 BIG-IP, plus Entra ID, Active Directory and IoT/CCTV. Get a graded review mapped to 16 security standards, with fix commands, a client-ready PDF report and a FortiGate migration script.
What it checks
The checks a senior firewall engineer runs in a rule review, done in seconds and explained in plain English with a fix for each finding.
Exposure
Any-any rules, every-port rules, RDP, SSH, SMB and databases open to the internet, clear-text protocols, over-broad ranges, platform default-allow.
Rule hygiene
Shadowed rules (blocks that never happen), redundant and disabled rules, unused and duplicate objects, missing comments.
Logging & hardening
Rules without logging, no remote syslog or NTP, Telnet/HTTP admin, internet-facing admin access, no MFA, default SNMP and admin accounts, end-of-support firmware.
Vulnerability scanner
Scan the IPs and assets you’ve verified you control — externally or with an installed agent inside. Find open ports and software versions, matched to CVE, CISA KEV and MITRE ATT&CK. No exploits; authorised targets only. Optional add-on.
MITRE ATT&CK mapping
Add an ATT&CK view to reviews and scans: every finding grouped by the adversary techniques it could enable, for threat-informed prioritisation and reporting. Optional add-on.
Network review
Review your whole network together — up to 10 firewalls (HA pairs included), 50 switches, your Wi-Fi, NAC and IoT/CCTV devices. Tick what's in or out. Firewalls are also checked against each other: VPN proposals, PFS, one-sided tunnels, access between sites and HA sync. It all rolls into one combined posture, standards view and ATT&CK map.
Switch review
Paste a switch config from Cisco IOS/IOS-XE, Cisco Nexus (NX-OS), Aruba (ArubaOS-CX & ProCurve), Juniper EX or FortiSwitch. Checks the management plane, VLAN hygiene, Layer-2 protections (BPDU/root guard, DHCP snooping, DAI), port access and logging.
Wi-Fi review
Paste a controller or AP config from Cisco Catalyst 9800 & AireOS, Meraki, Aruba, UniFi or FortiAP. Each SSID is checked for open/WEP/TKIP encryption, 802.11w/PMF, guest isolation, WPS, weak PSKs and cleartext management.
NAC review
Review a Network Access Control deployment. Paste a Cisco ISE / 802.1X access-switch config or an Aruba ClearPass export and we check the authentication methods (EAP-TLS vs PAP/MAB), open/monitor mode, dynamic VLAN/dACL segmentation, CoA, posture and profiling, guest isolation, the RADIUS secret and the management plane.
Azure NSG review
Paste an Azure Network Security Group export (az network nsg list JSON, an ARM template or a single NSG) and we read the rulebase like a firewall review — RDP/SSH, management and database ports open to the internet, any-to-any allows, over-broad port ranges and unrestricted egress — graded and mapped to the 16 standards and ATT&CK.
NetScaler / ADC review
Paste a Citrix NetScaler ns.conf (show ns runningConfig) and we read it like a firewall rulebase — management access on data IPs, Telnet/FTP, weak TLS (SSLv3, TLS 1.0/1.1, RC4/3DES ciphers), an unauthenticated Citrix Gateway (the Citrix Bleed class of issue), clientless VPN, admin MFA, default SNMP and syslog — graded and mapped to the 16 standards and ATT&CK.
F5 BIG-IP review
Paste a BIG-IP bigip.conf (or tmsh list /) and we walk the tmsh config like a firewall rulebase — the management plane reachable on an external self-IP, weak TLS on client-SSL profiles and the GUI (SSLv3, TLS 1.0/1.1, RC4/3DES), forwarding (any-to-any) virtual servers, HTTPS apps with no ASM/WAF, admin MFA, default SNMP, syslog and NTP — graded and mapped to the 16 standards and ATT&CK.
Entra ID & Active Directory
Guided identity reviews for the two directories most networks run on. Entra ID / Microsoft 365: MFA coverage, Conditional Access, legacy auth, privileged-role and PIM use, guest and app-consent controls, log retention. Active Directory: admin tiering, Kerberoasting, LLMNR/NTLM relay, LAPS, Print Spooler and a tested recovery plan.
Device & posture reviews
A guided checklist for anything without a parseable config — cameras, NVRs and IoT, and the remote-access / VPN appliances (Ivanti, NetScaler Gateway, SMA, Zyxel), ADCs / load balancers (F5, NetScaler) and SASE / SSE services (Zscaler, Netskope, Cloudflare, Cisco, FortiSASE). Graded and mapped to the same 16 standards and ATT&CK, and rolled into the whole-network review.
Known-exploited firmware
FortiOS, PAN-OS and RouterOS versions checked against CISA's KEV list, raised to high when the config shows the vulnerable feature exposed.
VPN & crypto
3DES, MD5 and SHA-1 proposals, weak DH groups, IKEv1 aggressive mode, tunnels without PFS, and SSL-VPN or admin access allowing TLS 1.0/1.1.
Fix commands
Ready-to-edit CLI for each finding in your platform's syntax, using your own rule names, policy IDs and interfaces. Menu steps where there's no CLI.
Change review
Paste the before and after config. See new and fixed findings, the score change and every rule edit, with a summary to paste into the change ticket.
Review sign-off & reminders
Record each periodic rule review as audit evidence (PCI DSS 1.2.7 asks for one every six months), and get an email when the next one is due.
Unused rules
Paste hit counts from the firewall and see which allow rules nobody has used, with the commands to remove them.
MSP client folders
Group devices by customer, brand reports with your logo and theirs, and see which clients have reviews overdue.
Free network tools
Email security check, MX, DNS, SPF, DMARC and DKIM lookups, reverse DNS, blacklist check, IP whois, subnet and CIDR calculators and more. Try them, no sign-up.
Device history & risk register
Score trend per firewall, and accepted risks with a reason and expiry that drop out of the score. Stored as one-way fingerprints, never hostnames.
Asset vulnerability alerts
List your firewalls and routers with their software version. We check them against the National Vulnerability Database and CISA’s known-exploited list every day, show each CVE with its CVSS score and fixed release, and email you when something new affects you. £1 per asset per day.
16 standards
Every finding mapped to controls with a pass, partial, fail or not-assessed summary per standard.
PDF reports
A client-ready report with grade, findings, fixes, compliance tables and a rule appendix. MSPs can add their own logo.
Config converter (any to any)
Convert a config between the main platforms — FortiGate, Cisco ASA & IOS, Palo Alto, Check Point, SonicWall, Sophos, Juniper SRX, WatchGuard, pfSense/OPNsense and MikroTik, with Cisco Firepower (FTD) supported as a source. Pick the target and get a draft config with a review list of everything a human needs to decide.
Platforms
Switch platforms
Wi-Fi platforms
NAC platforms
Cloud & identity
ADC / appliance config reviews
Also monitored for known-exploited CVEs
Every platform above is checked daily against NVD and CISA KEV by software version. These remote-access, VPN, ADC and SASE appliances are monitored too (by version — no config review needed):
SASE / SSE agents monitored
Cloud SASE is vendor-patched, so we track the endpoint agent / connector version each one deploys — these pick up CVEs and run with high privilege:
Standards
Your config never leaves your machine
How we keep it that way, and how to check it yourself
Firewall configs hold your network's secrets. So the analysis runs entirely in your browser. We never receive, store or log your configuration, findings, hostnames or IP addresses. The site's security policy blocks it from sending your config anywhere. Your account only records when a review ran, the platform, the rule count and the score, so we can apply your plan's limits.
How it works
- Export
Save the config from your firewall. The Help guide shows the exact command for each platform.
- Paste or open
The platform is detected automatically and the review runs locally.
- Fix and report
Work through the findings, then download a PDF for your client, auditor or change board.
Pricing
Plans are per company. Prices exclude VAT; Paddle, our payment provider, shows your local currency and any tax at checkout.
Asset vulnerability monitoring is an add-on for paid plans at £1 per asset per day, billed monthly. Payment is by credit or debit card. Have a discount code? Enter it on the billing page when you choose a plan. Cancel any time from your billing page; you keep access until the end of the period you've paid for.
Questions
Do you store my firewall configuration?
No. The config is read and analysed by code running in your browser. It is never sent to our servers. PDF reports are generated in your browser too.
Does a passing standard mean we're compliant?
No. The tool checks what a firewall configuration can show. It is guidance to help you prepare and fix issues, not an audit or certification. Your assessor decides compliance.
Can I trust the converted config?
Treat it as a draft, not a drop-in. It comes with a review list of everything that needs a human decision, and fidelity varies by platform pair — CLI/set-format targets (FortiGate, Palo Alto, Cisco, Juniper, MikroTik) convert most cleanly, while XML/GUI ones (Check Point, Sophos, WatchGuard, pfSense) are more of a scaffold. Always test on a lab or spare unit before applying it to production.
Can my team share an account?
Yes. Team and MSP plans include several users under one company, with owner, admin and member roles. Add more users at any time.
How do invoices and VAT work?
Paddle is our reseller and merchant of record. It takes the payment, charges the right VAT or sales tax, and emails a VAT invoice for every payment. Invoices are also downloadable from your billing page.
Review your first firewall in two minutes
Free plan, no card needed.
Create a free account