> Source: https://docs.nometa.az/v4.8.0/firewall-analyzer

# Firewall Analyzer

SAMURAI Networks includes a multi-vendor **firewall analyzer**, the
[Policy Analyzer](https://docs.nometa.az/md/v4.8.0/features/policy-analyzer.md). It reads the rule base of every
supported firewall, scores each rule for risk, flags shadowed and redundant rules, checks
zone segregation against a baseline, and traces every policy change back to the
responsible admin. This page explains what a firewall analyzer does and where SAMURAI
sits among the tools that share the name.

## What is a firewall analyzer?

A firewall analyzer is software that inspects firewall rule bases to answer what the
firewall's own UI cannot: which rules are risky or overly permissive, which are shadowed
or redundant, whether zone segregation matches your security policy, and what changed
since yesterday. Rule bases accumulate for years; an analyzer finds the rules to fix or
remove, with evidence.

## Firewalls SAMURAI analyzes

| Coverage | Platforms |
| --- | --- |
| Full policy analysis (risk, anomalies, cleanup, segregation, compliance packs) | Palo Alto (PAN-OS), Cisco FMC, Cisco FTD, FortiGate, Cisco ACI, Cisco ISE |
| Policy visibility, search and change tracking | Cisco ASA, Juniper SRX (see [Device Panels](https://docs.nometa.az/md/v4.8.0/device-panels.md)) |

The analysis covers:

- **Per-rule risk scoring** against operator-rated zone trust and criticality.
- **Anomalies**: shadowed, redundant and overly permissive rules, split into actionable and advisory.
- **Cleanup recommendations** with vendor-native config candidates you can review.
- **Zone segregation** checked against an interactive baseline matrix.
- **Compliance packs** written as YAML policy-as-code, reported per framework.

## How SAMURAI compares to other firewall analyzers

**ManageEngine Firewall Analyzer** works from firewall logs: traffic analytics,
bandwidth reports and log forensics, with rule administration on top. SAMURAI works from
configuration and state instead: it reads the rule base over each vendor's API or SSH,
needs no log feed, and covers the rest of the network (routers, switches, VMware
vCenter, Active Directory) in the same model.

**AlgoSec and Tufin** analyze firewall policy too, but their core job is change
orchestration: pushing rule changes through approval workflows. SAMURAI is agentless and
read-only by design. See the full
[capability comparison](https://docs.nometa.az/md/v4.8.0/introduction.md#how-samurai-networks-compares).

**Not a packet or RF analyzer.** "Network analyzer" names three unrelated tools:
protocol analyzers such as Wireshark capture live packets; vector network analyzers
(VNAs) are RF test instruments that measure impedance and VSWR; configuration and
firewall analyzers such as SAMURAI read device configuration and state. If you need
packet capture or RF measurement, SAMURAI is not that tool.

## Try it

The firewall analyzer ships in the standard image; there is no separate module or
license tier to install:

```bash
docker run -d -p 80:80 -p 443:443 beyrak44/samurai:latest
```

Follow [Getting Started](https://docs.nometa.az/md/v4.8.0/getting-started.md), onboard a firewall, and open
**Policy Analyzer** after the first sync. Access requires the `policy-analysis`
permission.