Bastion

Bastion is a pure-CLI firewall configuration audit tool that analyses exported firewall rulesets to identify security weaknesses, overly permissive rules, and compliance gaps. It accepts a directory of firewall configuration files or a single configuration file and applies a vendor-specific parser followed by a universal audit engine to produce structured findings.

The audit pipeline consists of two stages. First, the engine/parsers/ module auto-detects the firewall vendor (Cisco ASA, Palo Alto, Fortinet, pfSense, iptables, etc.) using signature-based detection and parses the configuration into a normalised ParseResult data structure. Second, the engine/audit_engine.py evaluates this parsed configuration against a library of security audit rules defined in audit_rules.yaml, checking for overly broad allow rules, missing deny-all defaults, insecure protocols, unused objects, shadowed rules, and compliance violations.

Bastion enriches its findings with threat intelligence: IP addresses and URLs referenced in firewall rules are checked against curated blocklists, and GeoIP country mapping identifies rules that permit traffic to or from high-risk jurisdictions. Output conforms to the universal pr0t31n schema (meta.json, findings.json, summary.json) with UPPERCASE risk values. When run under Crucible (CRUCIBLE_MANAGED=1), Bastion emits structured protocol tokens for real-time status and finding delivery.

CLI tool. Processes firewall configuration exports locally — no network access required during analysis. Input files should be stored with restricted permissions.

Bastion findings are generated by the audit engine against parsed firewall rules. Each finding references the specific rule or configuration line that triggered the detection, including the source/destination networks, service ports, and action (permit/deny). Risk levels range from CRITICAL (any-any permit with no logging) through INFO (informational configuration observations). Findings include the vendor-specific rule identifier and line number for precise remediation targeting. Threat-intel enriched findings include the blocklist source and GeoIP country for flagged IP addresses.

Bastion generates action items for rules requiring manual review — e.g., "Review any-any rule on interface Outside", "Verify business justification for inbound RDP from 0.0.0.0/0", "Confirm shadowed rule is intentional".