Book a demo
FARR

Firewall Access Rules Reviewer

Firewall Access Rules Reviewer

Know exactly what your firewalls allow — and prove every rule is justified.
FARR ingests the running configuration from every firewall in the estate — twelve vendors, auto-detected on upload or pulled live over SSH — and turns thousands of rules into an operating picture a security team can govern. It flags risky access, grades each device against a hardening baseline, maps how segments actually reach one another, re-reviews the moment a firewall changes, and proves every rule is still justified — every finding evidenced and exportable.
Request a live demo →

What you get

The outcomes that matter

Twelve vendors, one model

Upload any supported config and get the same rule findings, hardening checks and segment map.

Risky rules, flagged

Any-to-any, overly permissive, stale, expired, ownerless and unjustified rules — surfaced and ranked.

Critical paths, mapped

See how segments truly reach one another and which paths bypass a security control.

Inside FARR

Every module, end to end

FARR is organized into the work your team actually does — build the picture, govern it, and prove it. Each module below is part of one integrated platform.

Capture every configuration

Multi-Vendor Review
Auto-detects the vendor from any configuration and reviews it against a built-in criteria engine — twelve firewall families, one normalized model.
Offline Upload or Live Retrieval
Review an exported config file, or have FARR fetch the live config directly over SSH — host keys pinned on first contact to abort a man-in-the-middle.
Change-Triggered Reviews
FARR watches each connected firewall and re-runs a full review the moment an administrator changes it — flagging drift from the last approved state.

Find the risk

Access-Rule Risk Findings
Flags overly-permissive any/any rules, insecure services and ports, and shadowed or redundant rules — each tied to the exact rule by name and number.
Device Hardening Review
Grades every device pass / warn / fail across its management plane, SNMP, NTP, banners and password policy.
Administrator & Access-Role Register
Extracts the administrative accounts and roles from each config and marks which are privileged — least-privilege evidenced, not assumed.

Map the network

Network-Segment Classification
Auto-detects address objects, subnets, VLANs and interface IPs, then classifies each as PCI, SWIFT, Servers, End-users, DMZ and more.
User-Terminal Mapping
Register the PAM, DAM, proxy, ZTNA, VPN and jump hosts that should front access into each segment, and map what each covers.
Critical Access Findings
Surfaces any rule that lets an end-user segment reach a sensitive zone directly — bypassing the terminal that should front it.

Govern & prove

Recertification Campaigns
Scheduled campaigns over the rule base that record a certify, modify or revoke decision per rule — a defensible recertification trail.
Live Dashboard
A clickable KPI for every register — firewalls, rules, reviews, critical and high findings, hardening fails, admins, segments and terminals.
Enterprise Access Control
Five role profiles with database-enforced row-level security, plus directory sign-on with an encrypted bind credential.
Branded CSV & PDF Reporting
Export any register or review to CSV or a print-ready PDF carrying your organization’s name, logo and export date.
Immutable Activity Log
Every change, sign-in, authorization failure and retrieval event recorded with who, what, when, from where and the outcome.

How it works

From raw estate to evidence

  1. 01

    Onboard

    Register each firewall with its owner, criticality and optional SSH access.
  2. 02

    Review

    Upload or retrieve the config; the engine flags risky rules, hardening gaps and admin accounts.
  3. 03

    Map

    Classify segments by business scope and the terminals that should front them.
  4. 04

    Certify

    Surface critical access paths and run recertification campaigns — all on an immutable log.

Coverage

Reads the running configuration from every major firewall vendor — auto-detected on upload

Enterprise
Palo Alto PAN-OSFortinet FortiGateCisco ASACheck PointJuniper SRXSophos XGS
Network & SMB
SonicWallWatchGuardMikroTik RouterOS
Open-source & software
VyOSpfSenseOPNsense
Palo Alto in both XML and set-command form — twelve vendors in all, each yielding the same findings.

Added value

The value it creates

Rule review is the mechanism. This is what proving every firewall rule is justified is worth to the business.

See what’s allowed

Turn thousands of rules into a picture

Every rule across twelve vendors is normalised into one model a security team can actually govern.

Justify every rule

Prove access is intentional

Ownerless, stale and unjustified rules are surfaced and recertified, so every “permit” has a reason and an owner.

Contain the blast radius

Know how segments really connect

Segment mapping and critical-path detection show where a foothold could reach crown-jewel zones like PCI and SWIFT.

Continuous, not annual

Catch drift the moment it happens

Change-triggered reviews re-run on every firewall edit, replacing the once-a-year manual audit.

Regulatory fit

Where FARR fits your obligations

The frameworks that govern the network edge — and exactly how FARR helps you satisfy each.

PCI-DSS v4.0International

Delivers Requirement 1 network-security-control reviews and the mandated rule-set review at least every six months.

NIST SP 800-41International

Grades each device against firewall-policy and hardening guidance.

ISO/IEC 27001:2022International

Evidences A.8.20–A.8.22 (networks security, security of network services, segregation of networks).

SWIFT CSCFInternational

Backs control 1 — restrict internet access and segregate the SWIFT environment.

SAMA CSFKSA

Supplies the network-segmentation and rule-review evidence the financial framework expects.

NCA ECCKSA

Meets the network-security control requirements with evidenced device hardening.

UAE IA · NESAUAE

Provides firewall governance evidence for critical UAE infrastructure.

Risk mitigation

The risk it takes off the table

A single over-permissive rule can be the whole breach. Here is your exposure without FARR — and with it.

Without FARRWith FARR

No one knows the full set of what every firewall actually permits.

One normalised model of every rule across all vendors.

Any-to-any and overly-permissive rules hide in thousands of lines of config.

Risky rules flagged, graded and evidenced automatically.

Rules outlive their purpose; no one owns or removes them.

Stale, expired and ownerless rules surfaced for recertification.

You cannot show how an attacker would traverse the network.

Segment maps and critical paths expose the routes into sensitive zones.

Firewall changes go live with no review until the annual audit.

Change-triggered reviews flag drift the moment a config changes.

Deployment & security

Yours to run, built to defend

Every Televestigo platform deploys inside your environment and stays under your control — hardened, directory-integrated, and audit-ready from day one.

On-premise or sovereign cloud

Runs inside your own estate and owned by you — firewall configs never leave your control, and raw configs are never stored alongside findings.

Five roles, row-level scoped

Administrator, Compliance Officer, Firewall Owner, Reviewer and Auditor — owners scoped to only their own firewalls, enforced in the database.

Hardened by default

Directory bind secrets encrypted at rest, SSH host-key pinning on first contact, and CA-signed TLS through an in-platform CSR.

Evidenced & exportable

An immutable activity log over every action, with CSV and print-ready PDF evidence carrying your organization branding.

See FARR in your environment

Tell us about your systems and obligations. We'll come back with a clear, practical view of where you stand — and what we'd do next.

Book a demo →All platforms