Category: Automation
-
Are These Actually the Same Rules? A CheckPoint-to-Palo-Alto Migration Audit
Two firewalls that both call something “the address at 10.4.x.x” are not saying the same thing, if one of them stores that address as an object called dns-primary and the other stores it as a signed 32-bit integer with no name attached at all. Before anyone can ask whether a migration preserved the rulebase, both…
-
A Hit Counter Doesn’t Know When It Started Counting
A rule that has matched nothing in nine minutes and a rule that has matched nothing in eighty days look exactly the same in the output. I wrote about that moment on LinkedIn; this post goes deeper into the toolchain around that observation: three small Perl tools written to consolidate a set of independently managed…
-
The Firewall Was the Wrong Layer: Automating Threat Response with BGP
The Firewall Was the Wrong Layer: Automating Threat Response with BGP A LinkedIn post I wrote about this covers the story: a daily infosec email, a firewall policy cycle, and the decision to stop doing the same fix by hand. This post goes deeper into the mechanics behind Remote Triggered Black Hole (RTBH) routing. Specifically,…
-
460 Devices, No Documentation, and the Pipeline That Changed That
The engagement had 460 managed devices and no current topology documentation. Network topology automation was the only viable path — manual spreadsheet work would have taken weeks and produced a point-in-time artifact no one could re-run. The Cisco design team needed three structured deliverables before they could move: device inventory, physical topology graph, VLAN/service map.…