Resources
Understand the product before you buy it
The deliverable, the export guide, the method and the control library, all readable without an account
Sample report
A complete deliverable on a fictional configuration, including the scope and limitations section that states what could not be proven. This is the document a client receives.
Supported export guide
What to upload, and how to produce it
Supported today
- Palo Alto Networks PAN-OS, a standalone firewall: the configuration XML.
- A Panorama-managed firewall: the device state export (.tgz), from which ConfigProof builds the effective configuration (local configuration plus what Panorama pushed), or the merged configuration from the CLI or the XML API.
- Panorama, an XML export analyzed as a management model: device groups, shared, pre-rulebase and post-rulebase policy, templates, template stacks and variables.
- A bounded Panorama bundle: a ZIP holding the Panorama export plus one or more managed-firewall XML exports, matched with your confirmation before any asset is created.
- Fortinet FortiGate: the configuration backup (.conf), including a multi-VDOM backup, one analysis per VDOM.
- Cisco Secure Firewall Threat Defense: an FMC or cdFMC read by the ConfigProof Relay (the manager and every FTD it manages), an FDM read, or show running-config from the device.
- Cisco ASA: one SSH capture of show version, show failover and show running-config; on a multiple-context ASA, the system space and each context through changeto, one analysis per context.
- Check Point: a Security Management Server, Multi-Domain Server or Smart-1 Cloud read by the ConfigProof Relay (the manager and its gateways), or a gateway read over Gaia.
How to produce the export in the web interface
- 01Standalone firewall: Device > Setup > Operations > Export named configuration snapshot, and choose running-config.xml.
- 02Panorama-managed firewall: Device > Setup > Operations > Export device state. The .tgz holds the running configuration and what Panorama pushed. Upload it as it is.
- 03Panorama: Panorama > Setup > Operations > Export named Panorama configuration snapshot, and choose running-config.xml.
- 04Do not rename a file to disguise the vendor: ConfigProof detects vendor, version and export type from the content, not the file name.
Before you upload
- On a Panorama-managed firewall, Export named configuration snapshot gives only the firewall's local configuration: no device group rules and objects and no template settings. ConfigProof accepts it, but the device state or merged export is the complete one.
- A configuration export contains no logs, hit counts, sessions or routing table state, so nothing in the report will claim them.
- A Panorama-only export is a management-model analysis. It is not the effective configuration of every managed firewall.
- The raw file is deleted as soon as it is normalized. Keep your own copy if you need one.
Why an upload is refused
- The file is larger than 120 MB, which is the ceiling this deployment accepts.
- The file is not a configuration export: a tech support file or a saved error page from the browser. Export the configuration itself.
- The file was cut short by a download or copy, so the XML does not close. Export it again and check the size matches.
- A device state archive that expands beyond what an export holds.
- A device state archive that holds no running configuration, or more than one.
- The file is from a vendor ConfigProof does not read today.
From the CLI or the XML API
Firewall CLI, merged configuration (local plus what Panorama pushed). Save the output to a .txt or .xml file and upload it.
set cli pager off set cli config-output-format xml show config mergedFirewall or Panorama CLI, running configuration (on a managed firewall, local only)
set cli pager off set cli config-output-format xml show config runningFirewall XML API, merged configuration (the answer is wrapped in <response><result>, which ConfigProof accepts)
read -rs PANOS_API_KEY curl --cacert firewall-ca.pem -H "X-PAN-KEY: $PANOS_API_KEY" -G \ --data-urlencode 'type=op' \ --data-urlencode 'cmd=<show><config><merged></merged></config></show>' \ -o merged-config.xml "https://<firewall>/api/"Firewall XML API, device state archive
read -rs PANOS_API_KEY curl --cacert firewall-ca.pem -H "X-PAN-KEY: $PANOS_API_KEY" \ -o device-state.tgz "https://<firewall>/api/?type=export&category=device-state"Firewall or Panorama XML API, the configuration file (on a managed firewall, local only)
read -rs PANOS_API_KEY curl --cacert device-ca.pem -H "X-PAN-KEY: $PANOS_API_KEY" \ -o running-config.xml "https://<device>/api/?type=export&category=configuration"Firewall or Panorama CLI, copy a file off the device
scp export device-state to user@backup-host:/exports/ scp export configuration from running-config.xml to user@backup-host:/exports/
The API key is read without echo and sent as a header, so it stays out of shell history and URLs. Keep TLS verification on: point curl at the device's CA certificate instead of disabling it. A read-only admin role with XML API access is enough. CLI output may keep the prompt lines around the configuration: ConfigProof removes plain text before and after the document and refuses anything else around it.
What a configuration export cannot carry
- Serial number, hardware model, and the installed content, application, threat and GlobalProtect client versions. These are device state, not configuration.
- Session tables, hit counts, logs and the live state of tunnels and routes.
- To see those, the device has to be read directly over SSH or the API. Until ConfigProof reads a device that way, the report states these as not present rather than guessing them.
What each export contains
- Named configuration snapshot (firewall)
- The firewall's local configuration. On a Panorama-managed firewall it does not include the device group rules and objects or the template network and device settings Panorama pushed.
- Device state (firewall, .tgz)
- The running configuration and, on a Panorama-managed firewall, the pushed shared policy and template stack. ConfigProof keeps only those documents and discards the rest of the archive (copies, history, certificate information and other device state) before storing anything.
- show config merged (firewall)
- The effective configuration: local configuration combined with what Panorama pushed. Text output, no device state.
- show config running (firewall)
- The local configuration only, like the named snapshot.
- Named Panorama configuration snapshot
- Panorama's own configuration: device groups, templates, template stacks and shared policy. It does not include any firewall's local configuration.
How to build a Panorama bundle
- 01Export the Panorama configuration (Export named Panorama configuration snapshot) and each managed firewall's configuration XML.
- 02Put the XML files in one ZIP. A device state archive cannot go inside a bundle: upload it on its own.
- 03In New analysis, choose the Panorama bundle and upload the ZIP. Each firewall is matched to its Panorama by serial, and you confirm every match before anything is created or charged.
Analysis methodology
How a finding gets made, and what decides its severity
The pipeline
- 01Hardened parse of the export, with entity resolution and network access disabled.
- 02Vendor and version detection from content, never from the file name.
- 03Normalization into immutable entities plus a reference graph over every configuration relationship.
- 04Deterministic controls over the selected modules only.
- 05Evidence capture: control ID, configuration path, normalized values, affected entity IDs.
- 06Optional model enrichment of the wording, validated against a strict schema.
- 07Scoped Assessment Score and Configuration Coverage, always reported together.
Score and coverage, never one without the other
A score computed over four modules is not the same claim as a score computed over eighteen. ConfigProof shows the Scoped Assessment Score beside Configuration Coverage everywhere it appears, in the dashboard and in the report, and a scoped assessment carries a mandatory scope and limitations section.
Configuration Coverage The share of detected modules that received full control analysis. Modules you did not select stay visible as Not analyzed rather than disappearing.
Severity and confidence are separate axes
A finding can be severe and uncertain at the same time. Base severity comes from the control definition, confidence comes from the evidence available, and the two are never blended into one number that hides both. When you override a severity, the original machine value stays on the record with your reason beside it.
Language rules
The words are chosen so a reader cannot infer a claim the analysis did not make
- Configured Permitted Flow
- What the configuration permits. Not a statement that traffic flows.
- Configured Route
- A route present in the configuration. Not a learned or installed route.
- No configuration references found
- Said of an object. It is not the same as saying the object is unused in production.
- Candidate for runtime validation
- Said of a rule that looks unused. Without hit counts, no export can prove it.
- Review candidate
- Said of a merge or consolidation. Safe to merge is only used when every behavior-affecting field is proven equivalent.
Control library
Every control has a stable ID, a documented predicate, a positive and a negative fixture, and a supported-version note. This is the catalog the analyzer runs, in full
Where a control aligns with a recommendation of the CIS Palo Alto Firewall 11 Benchmark v1.2.0, that recommendation is cited as a reference. Only that version was checked. A reference is not a certification.
Data handling guide
The raw XML lifecycle, retention by plan, what is redacted before anything is logged, what support can see and how to report a vulnerability, all on one page.
Changelog
Product and analyzer changes that affect a result you already published
Control specification adopted
Assessment Cycles, module scope selection with acknowledgment, the Scoped Assessment Score beside Configuration Coverage, the report builder with immutable revisions, the WBS Planner and the Diagram Canvas.
Evidence levels on every finding
Findings now carry fact, derived, contextual or hypothesis alongside confidence, and human overrides are stored beside the original machine result rather than replacing it.
Raw configuration deletion receipt
The deletion timestamp for the uploaded file is recorded and shown on the assessment.
An analyzer version change never rewrites a published report revision. The revision records the analyzer version that produced it.
Still deciding?
Read the security page for the data handling detail, or start with the free preview and judge the output yourself.