Skip to content
ConfigProof
Sample report

A complete deliverable on a sanitized configuration

Every finding, its evidence, its remediation and the section that states what the analysis could not prove.

Analyze your own configurationRead the methodology

This is a sanitized sample on a fictional environment. No customer configuration is shown.

Sample, branch edge firewall

PAN-OS firewallPAN-OS 10.1.9PAN-BP 0.1.0claude-opus-5
72out of 100
Config scoreNeeds work
Scope
vsys1
Rules
114
Objects
380
NAT rules
12
Zones
4
Analyzed
Aug 28, 2026, 03:02 PM
Kept until
83 days left

Executive summary

This PAN-OS 10.1.9 firewall scores 72 out of 100. One critical finding stands out: a rule named Temp-Allow-All permits every source to every destination on every service, and it sits above the segmentation rules that follow it, so those rules never evaluate. Two high findings compound it, an inbound destination NAT that publishes an internal application server without a matching restrictive security rule, and an allow rule that carries no security profile group at all. Fixing those three items removes most of the measured exposure. The remaining findings are hygiene and review debt: undocumented rules, duplicate objects and dead objects that make the next review slower than it needs to be. Four items are reported as observations because the configuration alone does not prove them.

Written by claude-opus-5 from findings the engine had already produced.

Do these first

  1. Disable or scope Temp-Allow-All. It supersedes the three segmentation rules below it.
  2. Attach a restrictive security rule to the inbound destination NAT that publishes 10.20.4.15, or withdraw the publication.
  3. Bind the standard profile group to Allow-Partner-API so the permitted traffic is actually inspected.
  4. Remove or reorder Allow-Legacy-Backup, which is shadowed and never evaluates.
  5. Collect decryption and interface logs so the four observations can be confirmed or dismissed.

Findings

12 findings, sorted by risk

12 of 12

Passed15
Findings
SeverityFindingLearn more
Critical
High
High
Medium
Low
Low
Low
Low
Observation
Observation
Observation
Observation

Limits of this report

Stated by the engine, not by a person deciding what to admit.

  • Traffic logs were not supplied, so no finding claims that a rule is unused in practice.
  • The routing table and interface topology were read from the configuration only. Upstream devices may already block some of the exposure described here.
  • Decryption exclusions are frequently deliberate. Findings that depend on them are reported as observations.
  • This is a technical review of one configuration file. It is not a compliance certification.

Checks that passed

15 checks ran and found nothing to report.

Rendered from the bundled sample. The live service was not reachable.