Firewall and Perimeter Review

Flow chart of the Firewall and Perimeter Review engagement, 6 phases in order, each one selectable. Phase 1, Scoping and Baseline Selection. We list the firewalls, VPN concentrators and edge devices in scope and pick the matching CIS or vendor hardening baseline for each platform. Activities: Inventory firewalls, VPN concentrators and edge routers; Record platform, firmware version and management method; Select the CIS or vendor hardening guide per platform; Agree the external IP ranges we may probe. Hands over Device Inventory and Baseline Selection. Phase 2, Evidence and Config Collection. We collect device configurations and rule-base exports as read-only evidence, along with any network diagrams and change records you have. Activities: Collect running configurations and rule-base exports; Gather network diagrams and VLAN or zone definitions; Pull recent firewall change records and approvals; Request hit counts on rules where the platform records them. Hands over Configuration and Rule-Base Evidence Pack. Phase 3, Benchmark Comparison. We analyse configurations with Nipper and config parsers, mapping device hardening settings to CIS and vendor guides. Activities: Run Nipper against each device configuration; Parse rule bases for any-any and overly wide objects; Map device hardening settings to CIS and vendor guidance; Check management plane, SNMP and logging configuration. Hands over Device Hardening Scorecard. Phase 4, Manual Review of Risky Settings. We hand-review the rule base for overly broad, shadowed and unused rules, exposed management planes, and weak VPN and TLS settings that automated tools rank poorly. Activities: Identify shadowed, duplicated and zero-hit rules; Trace which rules permit inbound access to internal zones; Test segmentation between VLANs and trust zones; Review VPN authentication, split tunnelling and cipher settings; Check TLS on management interfaces with testssl.sh. Hands over Risky Rule and Setting Analysis. Phase 5, External Exposure Check. Using Nmap and firewalk-style probing we confirm what the perimeter actually presents from the outside, so findings reflect reality rather than intent. Activities: Scan agreed external ranges for reachable TCP and UDP services; Compare live exposure against what the rule base intends; Probe filtering behaviour with firewalk-style techniques; Confirm no management interface answers from the internet. Hands over External Exposure Evidence. Phase 6, Prioritised Findings and Re-Check. We rank findings by exposure, propose a safe rule-cleanup order, and re-review after changes to confirm the perimeter has tightened. Activities: Rank findings by external reachability and reach into the estate; Sequence rule removals from lowest to highest change risk; Draft the tightened rule wording for each change; Re-review the configuration and rescan the perimeter. Hands over Rule-Base Cleanup Plan and Re-Check Report. Each phase begins from the artefact the phase before it produced.