ManageEngine Firewall Analyzer is commercial log analysis and configuration auditing software for enterprise firewalls, VPNs, and proxy servers. Its server runs on Windows or Linux, while administrators work through a browser console. It analyzes device logs for traffic and security reports, and it examines firewall configurations for policy problems. ManageEngine offers a free trial and separate mobile clients.
Receiving device logs
A built-in syslog server collects events from network security devices without collection agents. Firewall Analyzer also imports log files from local machines or remote hosts. Administrators select a local file or supply a remote address and transfer credentials, then choose an import schedule. Dynamic filename patterns accommodate logs whose names change regularly, and an option skips records the parser cannot recognize.
Imports accept compressed ZIP files and the GZ archives that Firewall Analyzer creates. An import list shows each file’s source, processing status, and import time.
Traffic by user and protocol
Bandwidth reports divide traffic by firewall, host, user, and protocol. Graphs and tables show upload, download, and total data, with separate views for inbound, outbound, internal, and external traffic. Security reports cover events such as attacks, viruses, connection denials, and failed logins from device logs.
VPN reports identify the users who connect and the traffic they consume. Administrators can inspect top hosts, failed VPN logins, peak usage, and trends over time. User-group reports add connection counts, duration, and traffic totals. Protocol detail depends on whether the firewall includes that information in its VPN logs.
Finding an event
The search interface examines raw records, archives, or aggregate log data. Users choose devices and matching criteria, then decide whether results must match all conditions or any condition. Firewall Analyzer displays the matching records and can show raw or formatted logs.
Report profiles
Administrators name a report profile from a search and choose its reports. Administrators schedule profiles hourly, daily, weekly, monthly, or once. The server generates reports at those intervals and can email PDF or CSV output to recipients.
Assessing firewall rules
Rule usage reports count the events that match individual rules. Administrators can compare rules with high usage, examine protocol or destination breakdowns, and locate rules that traffic never uses.
Policy optimization examines relationships between rules, including redundancy and shadowing. Rule Suggestion identifies overly permissive rules and proposes narrower alternatives. Policy Fine Tuning examines broad Any or All service choices and lists the objects that a rule uses or leaves unused.
For a new rule that an administrator proposes, impact analysis compares it with the existing rule base before implementation. It reports anomalies, assesses relevant ports and services, and suggests a position within the rule order.
Configuration history
Firewall Analyzer retrieves configurations through a device’s command interface or API and captures subsequent changes periodically. Administrators compare running configurations or examine differences between startup and running settings. Exclusion criteria remove recurring lines from change reports for particular devices. Change notifications can reach administrators through email or SMS.
Compliance checks
Compliance audits examine firewall rules, objects, interfaces, access lists, and address translations against security requirements. Reports cover standards such as PCI DSS, ISO 27001, and NIST. A dashboard displays compliance status, while configurable false-positive criteria adjust the findings that appear in audit reports.
Alerts with an owner
Administrators define event criteria, bandwidth thresholds, and priorities for alert profiles. Anomaly profiles add filters for unusual traffic behavior. When a condition triggers, Firewall Analyzer can send email or SMS notifications, or run a program for a custom action.
The alert administration view supports assigning an owner, adding notes, and examining an alert’s history.
Retaining raw logs
Archive settings control when the server creates and compresses raw-log archives. Administrators can also create an archive immediately or disable archiving. Encryption protects archive contents, while hashes and timestamps support detecting changes to archive data. Users reload an archive into the database to generate reports from earlier activity.
Single site or distributed monitoring
| Edition | Scope |
|---|---|
| Standard | Traffic analysis, security reports, searches, dashboards, and alerts. |
| Professional | Standard functions plus rule analysis, configuration history, and compliance auditing. |
| Enterprise | Professional functions with distributed Probe servers and a Central console for multiple sites. |
Enterprise administrators view remote Probe reports through the Central console and provide different users with specific views. The Android and iPhone apps connect to an existing Firewall Analyzer server using its account credentials. Mobile users can inspect device traffic, rule usage, compliance status, and alarms.
