A firewall configuration analyzer for mixed-vendor estates.
SAMURAI is a self-hosted firewall configuration analyzer. It pulls security policies, NAT and decryption rules, objects and VPN tunnels straight from Palo Alto, FortiGate, Cisco FMC and Juniper SRX, and keeps them in one place you can search, diff and export. When a rule changes, you get the diff and the name of the admin who made it.
Updated June 2026
What it reads
All your rule bases, one search
Search Palo Alto, FortiGate and FMC rules together, filtered by zone, address, port or action. Filtering runs on the server, so large rule bases stay quick.
NAT and decryption
NAT rules show the real IPs behind their address objects, with SSL/TLS decryption policy right next to them.
Objects you don’t have to chase
Address and service groups are expanded when SAMURAI syncs, so a rule reads “HTTPS (tcp/443)” instead of a group name three levels deep.
Who changed it
Each policy change is diffed and tied to an admin: by commit on PAN-OS, by time window on FortiOS.
VPNs next to the rules
IPsec tunnels, IKE gateways, GlobalProtect sessions and SSL-VPN users, shown beside the policies that let their traffic through.
Where a flow actually goes
Simulate a flow hop by hop through firewalls, routers, switches and ACI fabrics to see which devices it crosses and which rule decides it.
Looking for an AlgoSec alternative?
AlgoSec, Tufin and FireMon are built around the rule lifecycle: recertification, approvals and change orchestration. SAMURAI doesn’t do those workflows. It does the analysis (effective access, rule hygiene and per-rule risk scoring), and it also sees the switches, fabrics and identity services around your firewalls. If your problem is six vendors and no clear record of what changed where, start here.
Scope
SAMURAI
Firewalls, routers, switches, ACI fabrics, ISE and vCenter in one view
Policy management suites
Firewall policy
Deployment
SAMURAI
One Docker container on your own VM, works air-gapped, data in about five minutes
Policy management suites
Appliance or SaaS rollout
Change visibility
SAMURAI
One change timeline across vendors, with the admin behind each change
Policy management suites
Change workflows for firewall policy
Policy analysis
SAMURAI
Effective access, shadowed, redundant and overly broad rules, per-rule risk
Policy management suites
Their strength: recertification, approvals and orchestration
If you run recertification campaigns and need approval workflows, a policy suite is worth what it costs. If you need to know what your firewalls allow, what changed and who changed it, across vendors and without sending your configuration anywhere, SAMURAI does that on a single VM.
Frequently asked questions
What is a firewall configuration analyzer?
It’s a tool that reads firewall configuration (policies, NAT, objects, VPNs) from the device itself and makes it searchable and comparable, instead of working from traffic logs. SAMURAI does this for Palo Alto, FortiGate, Cisco FMC/FTD and Juniper SRX. It resolves objects to real ports and protocols, works out effective access, and ties each change to an admin.
Which firewalls does SAMURAI support?
Palo Alto (PAN-OS), Fortinet FortiGate (FortiOS), Cisco Secure Firewall (FMC/FTD), Cisco ASA and Juniper SRX (Junos OS). It also shows the ACLs on Cisco routers and switches.
Is SAMURAI a firewall log analyzer?
No. It reads policy and configuration state from each device and never parses syslog or traffic logs, so you’re analyzing the rules and their changes, not the traffic. It can send its own events out as RFC 5424 syslog, but log analytics isn’t what it’s for.
Is there a free firewall analyzer option?
Yes. The Docker image on Docker Hub includes a free test license, no email needed, so you can point it at your own firewalls before you talk to us. Production licenses are per deployment and priced by device count.
Is SAMURAI an alternative to AlgoSec Firewall Analyzer?
For multi-vendor policy visibility, effective access, rule hygiene, change tracking and audit trails, yes. For automated rule recertification and approval workflows, no. AlgoSec is the specialist there.
Is there a FortiGate firewall analyzer in SAMURAI?
Yes. SAMURAI reads FortiGate through the FortiOS REST API: policies, NAT, address and service objects, routes, VPN tunnels and configuration changes. They show up in the same dashboard as your Palo Alto and Cisco rules.
Does SAMURAI analyze Cisco firewalls?
Yes. FMC/FTD access and NAT policies, objects and managed devices are fully supported, and ASA is read over SSH. ACLs on Cisco routers, switches and ACI fabrics appear alongside them.
Can SAMURAI run air-gapped?
Yes. It’s one self-contained Docker image with an offline OUI database and no telemetry. Nothing leaves your network.
How do I deploy it?
Run one container from Docker Hub on a VM that can reach your firewalls. It’s usually serving data about five minutes later.