capirca VS netbox-acls

Capirca could help with some of that https://github.com/google/capirca

Great question! Fortinet themselves have an open PR on Capirca which you can view here https://github.com/google/capirca/pull/222 It has been in a stalemate for years now because of CLA issues. I reached out to people I know there while I was quietly forking and I get the feeling they have lost steam dealing with Google on this which I don't blame them for. I pinged them again since we launched and if I don't hear anything I will begin to make my own since I know lots of people want it.

Sadly there's not much choice for Open Source software. FWBuilder is good (also supports Cisco and Procurve devices as well as iptables) but rather old. Capirca is actively maintained and supports a lot of target devices. Sadly I think that's about it for the open source policy management tools.

Have you looked at Capirca for the multi-vendor ACL generation part of it?

Capirca uses common definitions of networks, services and high-level policy files to generate network ACLs. This multi-platform solution was originally developed by Google for their own use but is now open source. rankinrez finds it a good way to document firewall rules and objects.

You could use capirca https://github.com/google/capirca I wrote a plugin that allows you to manage the ACLs in NetBox. See https://github.com/991jo/netbox_capirca_plugin Warning: The Features are currently very limited and it does not yet work with NetBox 3. The code is almost finished for 3.1, I will probably be able to release it next week.

If you’re using netbox , have a look at netbook-acls . Haven’t used it myself yet, but I’ve kept it in my „to look into“ tab group for when I need it.