Skip to content

Getting started

This quickstart walks you from an empty screen to your first analyzed change in a few minutes. You'll load a policy, make an edit, read the diff, focus a traffic scope, and check the policy's health.

Prerequisites

Firevyzer is a web app — there's nothing to install. Sign in and open app.firevyzer.com. You'll need an ACL in Firevyzer's JSON wire schema; if you don't have one handy, use the built-in sample policy in step 1.

1. Load a policy

On the start screen you have two options:

  • Drop an ACL file onto the upload zone, or click to browse. The file is a JSON document in the wire schema — an ordered list of rules.
  • Use a sample policy to explore the tool with a realistic ACL.
acl.json
{
  "rules": [
    { "srcip": "*", "dstip": "10.0.0.5",  "proto": "tcp", "dstpt": "22",     "action": "allow" },
    { "srcip": "*", "dstip": "10.0.0.10", "proto": "tcp", "dstpt": "80,443", "action": "allow" },
    { "srcip": "*", "dstip": "*",         "proto": "*",   "dstpt": "*",      "action": "drop"  }
  ]
}

The policy loads into an editable rule table. This first-loaded version becomes your baseline — every diff is measured against it.

2. Edit a rule

Edit any cell, or add, remove, and reorder rules. Everything re-analyzes reactively as you go.

For example, change the SSH rule's destination port from 22 to * — a common real-world slip that over-exposes the host.

Undo is safe to lean on

The editor keeps a full history. Use the toolbar Undo / Redo buttons or Cmd+Z / Cmd+Shift+Z (Ctrl+Z / Ctrl+Y on Windows). Revert returns to the baseline. A burst of typing in one cell collapses into a single undo step.

3. Read the diff

The Changes panel shows every flow whose verdict flipped, grouped into:

  • Newly allowed — now permitted that previously was not. A potential exposure.
  • Newly denied — now blocked that previously was allowed. A potential outage.

Each change is a traffic class, tagged with now by (the rule deciding it in the edited policy) and was by (the rule that decided it before). The port edit above produces one newly-allowed class: tcp · any → 10.0.0.5 : any except 22.

More on diffs

4. Focus a traffic scope

Use the scope controls to pin a class of traffic — a protocol, source, destination, or destination port. Every panel (Changes, Health, single-rule inspection) narrows to just those packets, so you can ask "what about traffic to 10.0.4.0/24?" and see only that.

Leave the scope blank to analyze all flows — the default.

More on tracing

5. Check policy health

Switch to the Health panel for a structural read on the current policy — independent of any edit:

  • Redundant rules that decide no packets (dead).
  • Partially shadowed rules whose traffic an earlier rule already decides.
  • Structure — the independent blocks the policy decomposes into.

More on health

6. Export

When you're happy with the edited policy, Export writes it back out as JSON in the same wire schema, ready to feed into your deployment pipeline.

Next steps