Read-Only Utility Automates Detailed Audits of UserGate NGFW Firewall Policies

A cybersecurity engineer at Gazprom CPS has created a specialized read-only utility that helps administrators audit complex UserGate NGFW firewall policies without risking any automatic modifications to live configurations.

The project began when manual review of more than 1000 firewall rules and 4500 related objects proved impractical. Temporary rules created for short-term tasks often remained active for years, becoming difficult to evaluate because descriptions were outdated, owners unknown, and hit counts low. The utility addresses this by pulling data exclusively through the UserGate XML-RPC API, normalizing references to zones, IP lists, services, users, and groups, and then running a series of checks that generate an Excel report.

Eleven Targeted Checks Without Automated Changes

The checks are divided into four logical groups. Lifecycle checks identify rules whose last hit was too long ago, rules with very low hit counts despite being enabled, long-disabled rules, and rules that have not been updated for extended periods. Permissive-access checks look for rules using Any source or destination combined with Any services, networks wider than a configured mask threshold, and services that implicitly include management ports such as SSH or RDP when the services list is empty.

Observability checks flag drop and reject rules that have logging disabled, as well as rules that are enabled but currently inactive due to time restrictions. Documentation checks detect empty rule descriptions or descriptions lacking references to change requests or task numbers, and they also identify duplicate rule signatures.

All findings are presented with explanations so administrators can make final decisions. The tool never deletes or alters rules; it only supplies evidence for manual review.

Handling UserGate Data Model Complexities

The utility carefully interprets UserGate semantics. An empty services list means Any, not nothing. Negated lists and empty negated lists are rendered distinctly to avoid false findings. Network lists, URL lists, and certain system objects are resolved through additional API calls, with statistics aggregated across cluster nodes. The entire dataset is saved as a JSON snapshot, allowing repeated analysis with different thresholds without reconnecting to the firewall.

The final deliverable is a multi-sheet Excel workbook containing a summary dashboard, a rules-by-checks matrix with red and green indicators, a main rules sheet with human-readable object names, and separate sheets for each check. Administrators can assign verdicts such as OK, requires attention, false positive, or exception directly on the main sheet; these verdicts propagate via formulas to all other sheets.

The first production run completed in approximately 24 minutes and flagged roughly 39 percent of rules, more than half of which matched multiple checks. The resulting report provides a focused queue for manual investigation rather than requiring sequential review of the entire policy.