12 firewall misconfigurations auditors find again and again

Firewalls rarely fail because the product is weak. They fail because of a rule someone added for a weekend migration and never removed. These are the twelve misconfigurations that turn up in firewall audits over and over — on every vendor.

1. "Any-any" allow rules

A rule allowing any source to any destination on any service turns the firewall into a router. They are usually added "temporarily" during troubleshooting. Every allow rule should name specific sources, destinations and services.

2. "Any" as the service

Even with tight addresses, allowing every port between two networks exposes far more than the application needs. Replace with the exact ports in use.

3. Shadowed and unused rules

A rule placed below a broader rule never matches; a rule with zero hits for months is probably obsolete. Both make the policy harder to read — and hard-to-read policies hide mistakes. Review hit counts and clean up regularly.

4. No security profiles on allowed traffic

Allowing traffic without IPS, antivirus, URL filtering or DNS security profiles (depending on vendor) means the firewall only checks addresses and ports. Apply threat-prevention profiles to rules that allow internet traffic.

5. Admin interface reachable from untrusted networks

The management GUI or SSH should only answer on a management interface, restricted to administrator subnets. Exposed management interfaces are a favourite initial-access target, and many recent firewall CVEs required exactly that exposure.

6. HTTP or Telnet for administration

Administration must use HTTPS and SSH only. Clear-text protocols leak admin credentials to anyone on the path.

7. No MFA and no lockout for admins

Firewall admin accounts are high-value. Require two-factor authentication, set a lockout threshold after failed logins, and use named accounts (via RADIUS/TACACS+/SAML) instead of a shared admin.

8. Logging switched off on rules

If allow and deny rules don't log, there is nothing to investigate after an incident. Log at least the end of each session for allowed traffic and all denies on internet-facing rules.

9. No remote syslog

Logs kept only on the firewall can be overwritten, or deleted by whoever compromised it. Forward them to a syslog server or SIEM.

10. Weak VPN cryptography

IKEv1, 3DES, SHA-1 and Diffie-Hellman groups 1, 2 or 5 are outdated. Use IKEv2 with AES-GCM or AES-256, SHA-256 or better, and DH group 14 or higher (19/20 preferred).

11. SSL VPN portals left wide open

Web-mode SSL VPN portals have been behind several major breaches. Disable features you don't use, require MFA, and keep the portal patched.

12. Firmware with known exploited vulnerabilities

Check the running version against the vendor's advisories and CISA's Known Exploited Vulnerabilities list. Firewalls sit on the edge; an unpatched edge device is the first thing scanned on the internet.