Firewall

Firewall roles (Palo Alto PA-series, Cisco ASA/FTD) are designed in the Firewall Studio— a stepped editor covering Device & HA, zones, address/service objects and groups, NAT (source PAT and static/destination, with port-forwarding), and security rules with one-click reordering. The Firewall tab on a selected device shows a live summary and opens the Studio. Rules and NAT are re-orderable — order is evaluation order on every vendor, and a rule you add lands above the trailing catch-all run rather than beneath it, so a new permit is not born shadowed by the deny it was meant to precede. An HA pair generates failover configuration for both members rather than two standalone configs, and policy can be synced to the peer in one action. Vendor-ready configs (PAN-OS set commands, ASA, FortiOS, an FMC listing for Firepower) plus a rules-and-hygiene handover report export from Publish → Firewall Handover. The reachability simulator is NAT-aware — static/destination NAT is applied before routing and source PAT on egress — so traces reflect the translated path, and the What-if step diffs a staged change against the live config before you commit it. The platform also hardens the management plane by default:

set deviceconfig system hostname edge-fw-01
set deviceconfig system dns-setting servers primary 8.8.8.8
set deviceconfig system ntp-servers primary-ntp-server server 10.1.1.1
set deviceconfig system service disable-telnet yes
set deviceconfig system service disable-http yes