Disclaimer
Effective
is a tool to help security and IT professionals find and fix firewall configuration issues. Please read this before relying on its results.
In short: everything the tool produces is generated automatically by scripts. It is offered on a reasonable-efforts basis with no guarantee of accuracy, it must be reviewed by a competent person before use, and we can't accept liability for changes you make to your systems based on it. The full position is in section 8 and section 11 of the terms.
Not an audit or certification
Reviews are automated checks of a configuration file. They are not an audit, penetration test, vulnerability scan, risk assessment, certification or legal advice. A good score, or a "pass" against a control, does not mean your network is secure or that you comply with any standard, law or regulation. Only an accredited assessor or auditor can confirm compliance.
Limited view
The tool only sees the configuration you supply. It can't see compensating controls, other security layers, network topology, threat context, or changes made after the export. Some rules, such as those based on users or applications, can only be partly analysed.
Standards mappings
Mappings to standards such as NIST, CMMC, HIPAA, SOC 2, NIS2, DORA, PCI DSS, ISO/IEC 27001, CIS Controls, BSI IT-Grundschutz, NCSC CAF and Cyber Essentials are our interpretation, for orientation only. Control titles are paraphrased. Standards change; always check the current official text. The edition of each standard we map to is listed on the data sources page. We are not affiliated with or endorsed by any standards body, regulator or certification scheme.
Converted configurations and scripts
Configuration conversion is done entirely by automated tooling: the source config is parsed by scripts and mapped onto the target platform by rules. No person checks the result. Vendors handle rule order, implied and default rules, NAT, objects, zones, VPNs, routing and user or application rules differently, so a converted script may be incomplete, may not behave the same as the original device, and may contain errors that allow traffic you meant to block or block traffic you need. The conversion notes flag some known gaps but not all of them.
Treat every converted script and fix command as an unverified draft. Before applying one:
- have it reviewed line by line by someone competent on the target platform;
- back up the target device and confirm you can roll back;
- test it on non-production or lab equipment; and
- apply it only through your normal change-control process.
You are solely responsible for any change made to your systems. To the extent the law allows, we accept no liability for loss or damage caused by applying converted output without that review and testing.
Vendor names
Fortinet, FortiGate, Cisco, Palo Alto Networks, Check Point, SonicWall, Sophos, Juniper, WatchGuard, Netgate, pfSense, OPNsense, MikroTik and other names are trademarks of their owners, used only to describe compatibility. We are not affiliated with any of them.