Netforge.ai Docs
Open the app →
Docs/Guide/Device Configuration/Firewall

Firewall

Relevant for:Professional ServicesEnterprise / NetOps
Where to find itCanvas→Firewall (toolbar)→Firewall Studio

Firewall roles (Palo Alto PA-series, Cisco ASA/FTD) are designed in the Firewall Studio— a stepped editor covering Device & HA, zones, address/service objects and groups, NAT (source PAT and static/destination, with port-forwarding), and security rules with one-click reordering. The Firewall tab on a selected device shows a live summary and opens the Studio. Rules and NAT are re-orderable — order is evaluation order on every vendor. Vendor-ready configs (PAN-OS set commands, ASA, FortiOS, an FMC listing for Firepower) plus a rules-and-hygiene handover report export from Publish → Firewall Handover. The reachability simulator evaluates security rules; NAT is not simulated. The platform also hardens the management plane by default:

set deviceconfig system hostname edge-fw-01
set deviceconfig system dns-setting servers primary 8.8.8.8
set deviceconfig system ntp-servers primary-ntp-server server 10.1.1.1
set deviceconfig system service disable-telnet yes
set deviceconfig system service disable-http yes
Why
Zone-based policy scales where interface ACLs don't: rules describe intent (“DMZ may reach DB on 5432”) instead of ports on boxes, and survive re-cabling. Disabling telnet/HTTP management closes the two most common cleartext exposures found in firewall audits.
Note
Interface IPs on PAN-OS render as commented hints — address them via the L3 model or Panorama, per your operating model.