Reduce Firewall Rule Permissiveness
Automaticallywith Automatic Policy Generator
Tufin’s Automatic Policy Generator™ (APG) helps you optimize your firewall rule bases, using
traffic history to design least-privilege rule sets that block communications from systems that
don’t regularly require access.
The APG can also accelerate the creation of a new rule base for new firewalls or adding aninterface to a firewall.
The APG analyzes firewall logs to determine actual business practices, and replaces overly
permissive rules with more granular rules, where overly permissive is defined as allowing
access that is unused. Tufin customers can run an APG job on a rule which will watch actual
business traffic for a specified amount of time and then suggest a recommended set of rules
to reduce the permissiveness of the existing rule, or users can import logs to provide Tufin thetraffic baseline data.

Tufin showed us everything we were doing wrong.

““Featuresy Can analyze real time logs or users
can import logs
y Run APG on an entire rule base, asection, or one ruley At-a-glance view of critical metrics— G2 Product Review, Enterprise >1,000 Employees

y Rule base suggestions are defined to:

Optimize Existing Firewalls - Rule Audit- Approximate a least-privilege state

Restrict existing rules that are too permissive. By analyzing the rule base, the APG can identify
the permissive rules on a firewall and provide alternatives that are more accurate. The APG
can be run on an entire firewall rule base, a specific section, or just one rule.

based on traffic history- Optimize for high performance- Facilitate easy management

San Fran - Revision 370 - Policy ‘Standard’ - r(Automatic Update) - Tue, 30 Aug 2022 07:11:08
Permissiveness

NameRule
Type

Source Destination
Zone
Zone

Source Address

Source User

Destination Address

Application
Identity

ServiceURL
Category

ActionAdditional Parameters
AWS

LOW
LOW

101

AccessFrom AWS

universal any

52

AllowYouTube
accessuniversal any

22

3

Allow FB
accessuniversal any

4Access to
Disabled Finance

universal any

any

AWS_10.10.100.0

Any

Cloud

Physical_DC_192.168.1.10
Physical_DC_192.168.2.20
Any
Physical_DC_192.168.3.30
Physical_DC_192.168.4.40

service-httpsssh-sharedstrictAny

AllowstrictWildFire
Shared-profany

host_192.168.1.82
Physical_DC192.168.2.20

Any

Network_10.3.3.0
YouTubeyoutubeservice-dns
service-httpservice-https

music

Allow

any

1.1.1.1

Any

192.168.1.82V

Any

applicationdefault

Any

Allow

any

Production

Any

Financedaum

applicationdefault

Any

Allow

You Tube

FinanceN/Astrict
DG-022 log
Production 032

5
Production
universal any
Disabled 0223

N/A

LOW

HIGH

HIGH

any

PM-bckp
VPN Access

Any

Production

AnyLDAP-PANMySQL-PAN

Any

Allow

6

universal any

any

Subnet_172.16.120.0
subnet_172.16.200.0_24

Any

Subnet_192.168.1.10

Anyservice-https

Any

Allow

427

web toapplication universal any
serversany

Subnet_192.168.1.0

Any

Subnet_192.168.2.0

Any

ANYAnyAllow

428

DB server
to infraapps

anySubnet_192.168.3.0

Any

Subnet_192.168.1.0

Any

ANY

Any

Allow

universal any

default
DG-022 log

Users
access towebServer

22default

Access to9
Disabled Tor-3422

LOW

610A-T222

universal any

universal any

any

RnD-bckp

anyA_192.168.3.5
Host_192.168.3.35
Test_server

AnyTorAny

A_172.16.40.80
Host_172.16.40.50

gmail

applicationdefault

Any

TOS-APPapplicationdefaultpeer-topeer

Allow

UIdefault
DG-022 log

Allow

The APG identifies the permissiveness level of each ‘accept’ rule, on a scale from 1 to 100.
Permissiveness measures how widely a rule is defined:y A rule with one source host, one destination host and one service has the smallest value - 1
y A rule with Source “ANY”, Destination “ANY” and Protocol “ANY” has the highest value - 100

www.tufin.com

1

all the rules that were
too permissive andToronto
N/A“APG allowed us to see

gave us a quick andeasy way to resolve
those with new rulesthat were tighter.

“LOW— G2 Product Review,
Enterprise >1,000 Employees© Copyright 2023 Tufin. All rights reserved.

Adding a New Firewall to Your Network
If you do not yet have a firewall policy in place, you can begin by configuring a relatively permissive policy, and leave it in place long enoughto produce logs. The APG can then translate these logs into a secure, optimized rule base.
The network traffic that users need is defined as allowed, while all other traffic is blocked. Rules are refined until they are as specific andaccurate as possible, replacing “Any” rules in the original policy with actual network addresses and services.
Since there is a tradeoff between the degree of permissiveness, and the size of the rule base, the APG allows you to interactively determine
how granular you want the rule base to be.

www.tufin.com
Copyright © All rights reserved. Tufin, Unified Security Policy, Tufin Orchestration Suite and Tufin logo are trademarks of Tufin. All otherproduct names mentioned herein are trademarks or registered trademarks of their respective owners. You may not copy, reproduce,
photograph, translate, transmit ,make available to the public, make derivative works, perform in public, rent , broadcast or make any
commercial use of the publication in full and / or in part without prior written approval.

DP20230321