Upload your PAN-OS config. Find risky rules in minutes.
Evidence-backed findings, exact rule paths and practical remediation. No sales call.
Two free analyses per month. No account needed for the first one.
PAN-OS firewall and Panorama
- deterministic checks
- 25deterministic checks
- max XML upload
- 25 MBmax XML upload
- commands run against your device
- 0commands run against your device
Five steps, no meeting in between
The whole loop runs in a browser tab while you are still in the change ticket.
- 01
Pick the scope
Firewall or Panorama, one vsys or all of them. ConfigProof reads what your export actually contains and tells you before it starts.
- 02
Upload the export
A PAN-OS XML export up to 25 MB. Nothing in the file is executed and no connection is ever made to your device.
- 03
Run the analysis
33 deterministic checks parse the configuration, resolve every object reference and score each finding against the rule pack.
- 04
Review the findings
Sorted by risk, each one with the exact xpath, a redacted snippet, a confidence value and remediation you can hand to the change owner.
- 05
Export the evidence
PDF for the client, a share link for the team, or delete everything the moment you are done.
33 checks across six categories
Rule pack PAN-BP 0.1.0. Every check declares the evidence it needs, and a check that cannot point at a real object is not allowed to raise a critical.
Counts read live from the rule pack.
- Policy hygiene
- 9 checks
- Rules that are too broad, undocumented, disabled forever, or silent in the logs.
- Security profiles
- 5 checks
- Traffic that is permitted but never inspected: no profile group, no threat prevention, no URL filtering, no WildFire.
- Objects
- 4 checks
- Duplicate addresses, dead objects, and groups so wide that any rule using them becomes a wildcard.
- Rule logic
- 4 checks
- Shadowing, redundancy and ordering, where the rule you read is not the rule that applies.
- NAT and exposure
- 3 checks
- Destination NAT that publishes internal hosts without a security rule narrowing who may reach them.
- Platform hardening
- 8 checks
- Management access, administrator roles, logging and time. The parts of the device that are not the rulebase.
This is what one finding looks like
Not a paragraph of advice. An object, a path, a score you can audit, and a next step.
Rule permits any source, destination, application and service
Why it matters
This rule matches every session the firewall sees and allows it. It is position 7 of 114, above Segment-DMZ-to-Core, Segment-Users-to-DMZ and Deny-Lateral-SMB, so none of those three rules can ever evaluate. Every zone pair is effectively permitted on every port.
Analysis
An any to any allow rule high in the rulebase converts the rest of the policy into documentation. The three segmentation rules underneath it describe an intent that the device is not enforcing, which is more dangerous than having no segmentation rules at all, because a reviewer reading the config from the bottom up will believe the segmentation exists.
Evidence
/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Temp-Allow-All']<entry name="Temp-Allow-All"> <from><member>any</member></from> <to><member>any</member></to> <source><member>any</member></source> <destination><member>any</member></destination> <application><member>any</member></application> <service><member>any</member></service> <action>allow</action> </entry>
Remediation
- Confirm with the change owner whether this rule is still needed. The name suggests it was meant to be short lived.
- If a real need exists, replace any with the specific zones, addresses and applications and move the rule below the segmentation rules.
- If it is not needed, disable it first, watch traffic logs for one change window, then delete it.
- Add a description and an owner tag to whatever replaces it so the next review does not repeat this conversation.
What this cannot tell you
- No traffic logs were supplied, so this report cannot say how much traffic currently depends on the rule.
Risk breakdown
- Exposure
- 5
- Privilege
- 4
- Impact
- 4
- Control gap
- 2
- Risk score
- 160
Confidence
Blast radius
412 hosts, 64 services
Related findings
- PAN-SEC-015-c04e2b
The exact object path
Paste the xpath straight into your own tooling. Nothing on this card is approximate or rounded.
Risk you can argue with
Exposure times privilege times impact times control gap. The four inputs are printed, so you can disagree with the number instead of trusting it.
Confidence is a separate axis
A finding can be severe and uncertain at the same time. We never blend the two into one number that hides both.
Blast radius when it is computable
How many hosts and services the finding actually reaches, whenever the configuration contains enough to work it out.
Code decides what is a fact. AI explains.
Every finding in a ConfigProof report was produced by a deterministic check reading a parsed configuration, and each one carries the exact path of the object that triggered it. If a check cannot point at an object, it is not allowed to raise a critical.
The model receives findings that already exist and have already been redacted. It returns JSON validated against a strict schema: narrative, remediation, limitations, grouping. It never invents a finding, never changes a severity, and never generates a single line of the page you are reading.
When the model is unavailable, the report still ships. You lose the narrative, not the findings.
- Every finding traces to a deterministic check and an object path.
- The model sees normalized findings, never the raw configuration.
- Model output is schema validated JSON, never markup.
- A model outage degrades the wording, not the analysis.
Your configuration is the most sensitive file you own
So the defaults are conservative, and they are published rather than promised.
- The XML is processed in memory and on an encrypted volume, then deleted at the end of your plan retention or the moment you press Delete now.
- Passwords, password hashes, private keys and secrets are redacted in the parser before anything is logged or sent to a model.
- The model receives normalized findings only. It never receives the raw configuration.
- Nothing in the file is ever executed. The future collector is read only and makes outbound connections only.
- TLS in transit, isolation per workspace, and an audit trail of who, what, when, which model and which rule pack.
- Every report states its own limitations: what could not be proven without logs or topology.
Card priced, not quote priced
Free to prove it works. Forty nine dollars for a single client report. Twenty nine a month if you do this often.
Critical findings are never hidden to force an upgrade. What paid plans add is volume, retention, export, white label and collaboration.
Where ConfigProof fits
The suites are excellent and expensive. The free tools are tied to a vendor or stop at the surface. ConfigProof sits in the gap: self service, priced on a card, evidence you can hand to a client.
Who it is for
Engineers, consultants and MSPs
ConfigProof
- Palo Alto BPA
- Palo Alto customers with a support account
- FireMon Free
- Teams evaluating FireMon
- Nipper
- Auditors and compliance teams
Getting started
Upload a file, no sales call
ConfigProof
- Palo Alto BPA
- Requires a vendor support account
- FireMon Free
- Sign up, vendor gated
- Nipper
- Quote and annual license
Works from an offline export
Yes, XML only, no device access
ConfigProof
- Palo Alto BPA
- Yes, vendor portal upload
- FireMon Free
- Varies by connector
- Nipper
- Yes, offline config supported
Exact object path on every finding
Yes, xpath printed and copyable
ConfigProof
- Palo Alto BPA
- Not published
- FireMon Free
- Not published
- Nipper
- Not published
Report you can hand to a client
PDF, white label from Consultant up
ConfigProof
- Palo Alto BPA
- PDF from the vendor portal
- FireMon Free
- In product
- Nipper
- PDF and other formats
Change diff between two configs
On the roadmap, phase 2
ConfigProof
- Palo Alto BPA
- Not published
- FireMon Free
- Paid tiers
- Nipper
- Paid tiers
Price
Free tier, 49 one time, from 29 per month
ConfigProof
- Palo Alto BPA
- Included with vendor support
- FireMon Free
- Free tier
- Nipper
- Annual license, quoted
Vendor capabilities change. This table was checked against public documentation and reflects our reading of it. If something here is out of date, tell us and we will correct it.
The things engineers ask first
What file do I upload?
A PAN-OS XML export of the running configuration, from the web interface under Device, Setup, Operations, Export named configuration snapshot, or from the CLI. Panorama exports work too and are detected automatically. Up to 25 MB.
Do you need access to my firewall?
No. ConfigProof reads a file. There is no connection to your device, no API credential, and nothing in the file is ever executed. Entity expansion and other XML attacks are blocked at parse time.
What happens to my configuration file?
It is processed in memory and on an encrypted volume, then deleted at the end of your plan retention or the moment you press Delete now. Logs keep only a hash of the file, never its contents.
Does the model decide what counts as a finding?
No. Every finding comes from a deterministic check with an object path attached. The model writes narrative and remediation around findings that already exist, and it never generates the page you are reading. If it fails, the report ships without the narrative.
Is this a compliance certification?
No. ConfigProof performs an evidence-backed technical review. Some checks reference the CIS PAN-OS Benchmark because auditors recognize it, but a reference is not a certification and we will not claim otherwise.
Does the free plan hide my critical findings?
No. Free counts and lists every finding, criticals included. What Free limits is full evidence and remediation detail beyond the five highest risk findings, plus PDF export and retention. We will not hold a critical hostage.
Which vendors do you support?
PAN-OS firewall and Panorama exports today. FortiOS and Cisco FMC are the next adapters. We would rather do one vendor properly than four of them badly.
Can I use this on a client engagement?
Yes. The 49 dollar Report plan covers one configuration with no subscription. Consultant adds a workspace per client and a PDF with your own logo.
Bring the config you already worry about
The one with the rule somebody added during an incident two years ago. Two analyses a month are free and you do not need an account for the first one.
For engineers who have to justify every rule change inside a maintenance window.