A free firewall assessment you run yourself, on FortiGate, Cisco ASA, Palo Alto, Juniper SRX and five more platforms. One file. No installer, no dependencies, no network access — it runs on the machine that holds the backup, so the configuration never moves.
Double-click to run. Works on Intel and Apple silicon.
Download · 72 KBSHA-256 eb5fbcb92eea40994ac6d3716fc01c6961c8f01929094c474fdf7cf86ee6ebff
Double-click to run. Windows 10 and 11.
Download · 71 KBSHA-256 63bb6a694cbe8963a58cc931f338f75cc347a5542ae2a6df9e8efa6428f9e1b5
The bare archive, for running from a shell or in a pipeline.
Download · 70 KBSHA-256 6927fc0ec7f63b1e3dedcc7df5295f88b42ff8119beddcf47529879010857701
It needs Python 3.10 or later. macOS and most Linux distributions already have it. On Windows, install it from python.org and tick “Add python.exe to PATH”. The launcher tells you if it is missing.
Unzip, then double-click Run Review. It asks you to drag in the configuration backup, writes a PDF beside it and opens it.
xattr -dr com.apple.quarantine ~/Downloads/securexcel-review-macos
Or open System Settings → Privacy & Security, scroll to Security and press Open Anyway. Either way it is a one-time step.Signing the launcher would remove that step, and needs an Apple Developer account. Until then we would rather tell you the file is unsigned than have you click past a security warning without reading it. If you would rather not run an unsigned script at all, use the command line below — it is the same engine.
Or from a shell, which is the same engine:
python3 securexcel-review.pyz backup.conf --format pdf
python3 securexcel-review.pyz backup.conf --format bundle --anonymise
Information security policy at most regulated organisations forbids network-device configurations being sent to any third party, and increasingly names AI services explicitly. That is the correct policy. It also means the organisations most in need of a configuration review are the least able to obtain one through a portal.
This tool exists for exactly that constraint. It reads the backup locally, applies 21 deterministic controls, and writes the report to a file on the same machine. Nothing is transmitted. The build will not produce an archive if any networking module is reachable from it, and the test suite completes a full review with the socket layer disabled, so the guarantee is enforced rather than asserted.
The vendor is detected automatically from the backup — you do not need to tell it what you are running. If your platform is on this list, the firewall assessment works on it.
| Fortinet FortiGate | FortiOS configuration backups, including multi-VDOM. Policies, address and service objects, interfaces and zones, administrative access and VPN configuration. |
|---|---|
| Cisco ASA | Running or startup configuration. Access lists, object groups, NAT, interfaces with security levels, AAA and management access. |
| Cisco IOS and IOS-XE | Router and layer-3 switch configurations. Access lists, line configuration, SNMP, logging and NTP. |
| Palo Alto PAN-OS | XML configuration export. Security rules, address and service objects, zones and interfaces. |
| Juniper SRX | Set-format or curly-brace configuration. Security policies, zones, address books and applications. |
| MikroTik RouterOS | Export files. Filter rules, address lists, interfaces and the management services including Winbox and the API. |
| pfSense and OPNsense | XML configuration backups. Filter rules, aliases, interfaces and the web administration interface. |
| Linux iptables | iptables-save output. Chains, policies, rules and their targets. |
| AWS security groups | The JSON that aws ec2 describe-security-groups
produces. Ingress and egress permissions across every group in the
document. |
Twenty-one deterministic controls, each mapped to a published standard. The same configuration always produces the same findings, and every finding names the rule it came from.
Findings are graded by severity and scored, with the same scale used across every platform, so a FortiGate and a Cisco ASA can be compared directly. Reports are produced as HTML, PDF, JSON or text, and the tool returns a non-zero exit status when findings meet a severity threshold you choose, so a firewall rule review drops straight into a pipeline.
The tool tells you what your rules permit. It cannot tell you which permissive rule is deliberate, which is forgotten, and which is dangerous in your topology specifically. That judgement is what a reviewed firewall assessment adds.
The report the tool produces is complete and it is yours. What it cannot be is a report an external auditor will accept, because that requires a named reviewer who carries responsibility for the conclusion.
For that, the tool emits an attestation bundle: the findings, and a cryptographic hash of the configuration. It contains no configuration text of any kind, and an option withholds device and rule names as well. Send the bundle for review; retain the backup. We assess the findings, countersign the report, and issue a closure certificate once remediation is verified.