Skip to content

Supported ACL formats

Firevyzer reads and writes firewall ACLs as JSON in a single wire schema: an ordered list of rules, evaluated first-match top-to-bottom with an implicit trailing default-deny.

Coming soon: native vendor formats

Today Firevyzer ingests the JSON wire schema below. Native import for the major firewall vendors is on the roadmap, so you'll be able to point Firevyzer at a config straight from the box — no hand-translation:

  • Cisco — ASA / IOS access lists
  • Palo Alto Networks — PAN-OS security policies
  • Fortinet — FortiGate firewall policies

Which format do you need first?

We're prioritizing vendor support by demand. If one of these would unblock you, let us know — it helps us sequence the work.

The ACL document

acl.json
{
  "rules": [
    { "srcip": "*", "dstip": "10.0.0.5",  "proto": "tcp", "dstpt": "22",     "action": "allow" },
    { "srcip": "*", "dstip": "10.0.0.10", "proto": "tcp", "dstpt": "80,443", "action": "allow" },
    { "srcip": "*", "dstip": "*",         "proto": "*",   "dstpt": "*",      "action": "drop"  }
  ]
}

The top-level object has a single key, rules, holding the ordered list. Evaluation is first-match, top-to-bottom, and there is always an implicit default-deny after the last rule.

A rule

Every match field defaults to * (match anything) — only action is required.

Field Form Examples
srcip, dstip * · dotted IPv4 · CIDR (any prefix length) "10.0.0.5", "10.0.0.0/8", "10.0.0.0/12"
proto * · name · IANA number "tcp", "udp", "icmp", "6"
srcpt, dstpt * · port · comma list · range · mix "22", "80,443", "1024-2048", "22,1024-2048"
action allow / drop, with synonyms "allow", "drop", "permit", "deny", "block"

Addresses

srcip and dstip accept a single dotted IPv4 address, a CIDR block of any prefix length, or * for any. Non-octet-aligned prefixes like /12 are fine.

Protocols

proto accepts a name (tcp, udp, icmp), an IANA protocol number as a string (6, 17, 1), or * for any.

Ports

srcpt and dstpt accept a single port, an inclusive range (lo-hi), a comma list, or any mix of those — e.g. 22,1024-2048. Use * for any.

Actions

action is the only required field. allow and drop are canonical; permit, deny, and block are accepted synonyms.

Comments and names are preserved

Extra keys are tolerated. A rule's _comment or name is surfaced in the UI as the rule's label, so a reference can read "rule 2 · admin SSH" instead of a bare index.

Validation

A malformed ACL — an unknown field, protocol, port spec, or action — is rejected rather than silently coerced. Fix the offending rule and reload.

Exporting

The app's Export action writes the current (edited) policy back out in this exact schema, so a Firevyzer export drops straight back into your deployment pipeline.