PermitANY
SecurityPrompt

ACL / Firewall Policy Security Review

Paste your ACL, firewall policy, or security filter and get a security analysis: permit-any rules, missing explicit deny, shadow entries, and optimization suggestions. Supports Cisco IOS/IOS-XE/IOS-XR/NX-OS, Juniper Junos, Arista EOS, Palo Alto PAN-OS, and Fortinet FortiOS.

27 copies
ChatGPTClaudeGemini

Customize variables

Platform where this ACL or policy is applied (e.g. Cisco IOS-XE, Juniper Junos, Palo Alto PAN-OS, Fortinet FortiOS, Arista EOS)

Explain what this ACL or policy is supposed to do and where it is applied

Paste the full ACL, firewall filter, or security policy configuration

Tips for better results

  • ·Paste the policy exactly as it appears in 'show running-config' or equivalent — line numbers help
  • ·Mention the traffic direction (inbound/outbound) and interface type (WAN, LAN, DMZ, trust/untrust zone)
  • ·For Cisco: include hit counts from 'show ip access-lists <name>' if available
  • ·For Palo Alto: include the zone names and whether this is a pre/post rulebase
  • ·For Juniper: include the routing-instance name if this is a VRF-specific filter
  • ·For FortiOS: include the VDOM name if multi-VDOM is enabled

Prompt preview

○ VENDOR○ ACL_PURPOSE○ ACL_CONFIG
You are a senior network security engineer reviewing an access control policy for security issues. You have deep expertise across Cisco IOS/IOS-XE/IOS-XR/NX-OS, Juniper Junos, Arista EOS, Palo Alto PAN-OS, and Fortinet FortiOS.

Vendor / OS: [Vendor / OS]
Policy purpose: [ACL / policy purpose and where it is applied]

Configuration:
```
[ACL / Policy Configuration]
```

Please analyze this policy and provide:
1. **Security issues** — rules that create unintended access (permit any any, overly broad entries, missing deny-all at end)
2. **Logic issues** — shadow rules (rules that can never match due to earlier entries), incorrect order, missing explicit deny
3. **Optimization** — redundant entries, entries that can be combined or simplified
4. **Corrected policy** — provide the full rewritten policy that achieves the stated purpose securely, using the correct syntax for [Vendor / OS]

For each issue, cite the specific line or rule name. Format: Issue → Impact → Fix.
Use the correct CLI syntax and terminology for [Vendor / OS] throughout your response.

Tags

aclsecuritymulti-vendorreviewcompliancefilteringfirewall