.. 제목: 방화벽 정책 분석기
.. 슬러그: 방화벽 정책 분석기
.. 날짜: 2026-04-07 12:00:00 UTC
.. 태그: 방화벽, ACL, 보안, 시스코, 팔로알토, fortigate, 네트워킹, 도구
.. 카테고리: 도구
.. 링크:
.. 설명: Cisco ASA, Cisco IOS ACL, Palo Alto 또는 Fortigate 방화벽 정책 출력을 붙여넣어 섀도잉된 규칙, 중복 및 허용된 캐치올을 완전히 클라이언트 측에서 탐지합니다.
.. 유형: 텍스트
<style>
.calc-container { max-width: 1100px; margin: 20px auto; padding: 20px; }
.calc-header { margin-bottom: 30px; padding: 25px; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); border-radius: 12px; box-shadow: 0 4px 6px rgba(0,0,0,0.1); color: white; }
.calc-header h2 { margin-top: 0; color: white; font-size: 28px; margin-bottom: 10px; }
.calc-header p  { margin: 10px 0; opacity: 0.95; font-size: 15px; }
.result-section { background: white; border: 1px solid #e0e0e0; border-radius: 8px; margin-top: 20px; overflow: hidden; box-shadow: 0 2px 4px rgba(0,0,0,0.05); }
.section-header { padding: 16px 20px; background: linear-gradient(135deg, #4CAF50 0%, #2d6a2d 100%); color: white; font-weight: 600; font-size: 16px; }
.section-content { padding: 20px; background: #fafafa; }
@media (max-width: 768px) { .calc-header h2 { font-size: 22px; } .calc-container { padding: 10px; } }
textarea { width: 100%; height: 220px; font-family: 'Courier New', monospace; font-size: 13px; border: 1px solid #ccc; border-radius: 6px; padding: 10px; box-sizing: border-box; resize: vertical; background: #1e1e2e; color: #cdd6f4; }
.btn { padding: 10px 24px; background: #4CAF50; color: white; border: none; border-radius: 6px; font-size: 15px; cursor: pointer; margin-right: 8px; }
.btn:hover { background: #388e3c; }
.btn-secondary { background: #6b7280; }
.btn-secondary:hover { background: #4b5563; }
.format-btn { padding: 5px 14px; font-size: 13px; border: 1px solid #ccc; border-radius: 4px; cursor: pointer; background: white; margin-right: 4px; margin-bottom: 8px; }
.format-btn.active { background: #4CAF50; color: white; border-color: #4CAF50; }
table { width: 100%; border-collapse: collapse; margin: 0; font-size: 13px; }
th { background: #2d6a2d; color: white; padding: 8px 10px; text-align: left; white-space: nowrap; }
td { padding: 7px 10px; border-bottom: 1px solid #e5e7eb; vertical-align: top; font-family: 'Courier New', monospace; font-size: 12px; }
tr.issue-shadow td { background: #fef3c7; }
tr.issue-dup    td { background: #ede9fe; }
tr.issue-perm   td { background: #fff1f2; }
tr.action-deny td:first-child { border-left: 4px solid #ef4444; }
tr.action-permit td:first-child { border-left: 4px solid #22c55e; }
.badge { display: inline-block; padding: 1px 7px; border-radius: 10px; font-size: 11px; font-weight: 600; margin-right: 3px; white-space: nowrap; }
.badge-shadow  { background: #fde68a; color: #92400e; }
.badge-dup     { background: #ddd6fe; color: #4c1d95; }
.badge-perm    { background: #fee2e2; color: #991b1b; }
.summary-card { display: inline-block; padding: 12px 18px; border-radius: 8px; margin-right: 12px; margin-bottom: 12px; text-align: center; min-width: 100px; }
.card-ok     { background: #d1fae5; color: #065f46; }
.card-warn   { background: #fef3c7; color: #92400e; }
.card-danger { background: #fee2e2; color: #991b1b; }
.card-info   { background: #dbeafe; color: #1e40af; }
.card-num { font-size: 28px; font-weight: 700; }
.card-lbl { font-size: 12px; }
</style>
<div class="calc-container">
<div class="calc-header">
<h2>방화벽 정책 분석기</h2>
<p>Cisco ASA, Cisco IOS ACL, Palo Alto 또는 Fortigate 정책 출력을 붙여넣어 숨겨진 규칙, 중복 및 과도한 권한이 부여된 항목을 탐지합니다. 이 모든 작업은 브라우저에서 처리됩니다.</p>
</div>
<div class="result-section">
<div class="section-header">입력</div>
<div class="section-content">
<div style="margin-bottom:10px;">공급업체 형식:<button class="format-btn active" id="fmt-asa" onclick="setFmt('asa')">시스코 ASA</button>
<button class="format-btn" id="fmt-ios" onclick="setFmt('ios')">시스코 IOS ACL</button>
<button class="format-btn" id="fmt-palo" onclick="setFmt('palo')">팔로알토</button>
<button class="format-btn" id="fmt-fortigate" onclick="setFmt('fortigate')">Fortigate</button>
</div>
<textarea id="policyInput" placeholder="Paste firewall policy here..."></textarea>
<div style="margin-top:12px;">
<button class="btn" onclick="analyze()">분석하다</button>
<button class="btn btn-secondary" onclick="loadExample()">로드 예</button>
<button class="btn btn-secondary" onclick="clearAll()">분명한</button>
</div>
</div>
</div>
<div id="resultsDiv" style="display:none;">
<div class="result-section" style="margin-top:16px;">
<div class="section-header">요약</div>
<div class="section-content" id="summaryDiv"></div>
</div>
<div class="result-section" style="margin-top:16px;">
<div class="section-header">정책 규칙</div>
<div class="section-content" style="padding:0;overflow-x:auto;">
<table>
<thead>
<tr>
<th>#</th><th>행동</th><th>규약</th>
<th>원천</th><th>목적지</th><th>Dst 포트</th>
<th>이름 / 설명</th><th>문제</th>
</tr>
</thead>
<tbody id="policyTableBody"></tbody>
</table>
</div>
</div>
</div>
</div>
<script>
(function () {
'use strict';

let currentFmt = 'asa';

// ── Examples ─────────────────────────────────────────────────────────────
const EXAMPLES = {
  asa: `access-list OUTSIDE_IN extended permit tcp any host 10.0.0.10 eq 80
access-list OUTSIDE_IN extended permit tcp any host 10.0.0.10 eq 443
access-list OUTSIDE_IN extended permit tcp any host 10.0.0.10 eq 443
access-list OUTSIDE_IN extended permit tcp any 10.0.0.0 255.255.255.0 range 1024 65535
access-list OUTSIDE_IN extended permit tcp any any eq 80
access-list OUTSIDE_IN extended permit tcp 192.168.1.0 255.255.255.0 host 10.0.0.10 eq 80
access-list OUTSIDE_IN extended deny ip any any log`,

  ios: `ip access-list extended WEB_FILTER
 10 permit tcp 192.168.1.0 0.0.0.255 any eq 80
 20 permit tcp 192.168.1.0 0.0.0.255 any eq 443
 30 permit tcp any any eq 80
 40 permit tcp 192.168.1.0 0.0.0.255 any eq 80
 50 permit ip any any
 60 deny   ip any any log`,

  palo: `security {
    rules {
        "allow-web" {
            from [ trust ];
            to [ untrust ];
            source [ 192.168.1.0/24 ];
            destination [ any ];
            application [ web-browsing ssl ];
            service [ application-default ];
            action allow;
        }
        "allow-any-out" {
            from [ trust ];
            to [ untrust ];
            source [ any ];
            destination [ any ];
            application [ any ];
            service [ any ];
            action allow;
        }
        "block-specific" {
            from [ trust ];
            to [ untrust ];
            source [ 192.168.1.100/32 ];
            destination [ any ];
            application [ any ];
            service [ any ];
            action deny;
        }
        "block-all" {
            from [ any ];
            to [ any ];
            source [ any ];
            destination [ any ];
            application [ any ];
            service [ any ];
            action deny;
        }
    }
}`,

  fortigate: `config firewall policy
    edit 1
        set name "allow-http"
        set srcintf "internal"
        set dstintf "wan1"
        set srcaddr "192.168.1.0/24"
        set dstaddr "all"
        set action accept
        set service "HTTP"
    next
    edit 2
        set name "allow-https"
        set srcintf "internal"
        set dstintf "wan1"
        set srcaddr "192.168.1.0/24"
        set dstaddr "all"
        set action accept
        set service "HTTPS"
    next
    edit 3
        set name "allow-all-out"
        set srcintf "internal"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set service "ALL"
    next
    edit 4
        set name "block-shadow"
        set srcintf "internal"
        set dstintf "wan1"
        set srcaddr "192.168.1.50/32"
        set dstaddr "all"
        set action deny
        set service "ALL"
    next
end`
};

function setFmt(fmt) {
  currentFmt = fmt;
  document.querySelectorAll('.format-btn').forEach(b => b.classList.remove('active'));
  document.getElementById('fmt-' + fmt).classList.add('active');
}
window.setFmt = setFmt;

function loadExample() {
  document.getElementById('policyInput').value = EXAMPLES[currentFmt];
}
window.loadExample = loadExample;

function clearAll() {
  document.getElementById('policyInput').value = '';
  document.getElementById('resultsDiv').style.display = 'none';
}
window.clearAll = clearAll;

// ── IP helpers ───────────────────────────────────────────────────────────

function ipToInt(ip) {
  return ip.split('.').reduce((acc, o) => (acc << 8) | parseInt(o, 10), 0) >>> 0;
}
function prefixMask(len) {
  return len === 0 ? 0 : ((~0 << (32 - len)) >>> 0);
}
function wildcardToLen(wildcard) {
  const w = ipToInt(wildcard);
  const inv = (~w) >>> 0;
  let len = 0;
  for (let i = 31; i >= 0; i--) {
    if (inv & (1 << i)) len++; else break;
  }
  return len;
}
function cidrToNet(cidr) {
  if (!cidr || cidr === 'any' || cidr === 'all') return 'any';
  if (cidr.includes('/')) {
    const [net, lenStr] = cidr.split('/');
    return { net, len: parseInt(lenStr, 10) };
  }
  return { net: cidr, len: 32 };
}
function parseSrcDst(token) {
  if (!token || token === 'any' || token === 'all') return 'any';
  return cidrToNet(token);
}
function portSpec(keyword, val) {
  if (!keyword || keyword === 'any') return 'any';
  if (keyword === 'eq') return { from: parseInt(val, 10), to: parseInt(val, 10) };
  if (keyword === 'range') {
    const [a, b] = val.split(' ');
    return { from: parseInt(a, 10), to: parseInt(b, 10) };
  }
  const NAMED = { http: 80, https: 443, ssh: 22, telnet: 23, ftp: 21,
                  smtp: 25, dns: 53, snmp: 161, rdp: 3389, bgp: 179 };
  const n = NAMED[keyword.toLowerCase()];
  if (n) return { from: n, to: n };
  const num = parseInt(keyword, 10);
  if (!isNaN(num)) return { from: num, to: num };
  return 'any';
}
function serviceToPort(svc) {
  if (!svc || svc === 'any' || svc === 'ALL' || svc === 'application-default') return 'any';
  const NAMED = { HTTP: 80, HTTPS: 443, SSH: 22, TELNET: 23, FTP: 21,
                  SMTP: 25, DNS: 53, SNMP: 161, RDP: 3389, BGP: 179 };
  const n = NAMED[svc.toUpperCase()];
  if (n) return { from: n, to: n };
  return 'any';
}

// ── Parsers ───────────────────────────────────────────────────────────────

function parseASA(text) {
  const rules = [];
  for (const line of text.split('\n')) {
    const m = line.trim().match(
      /^access-list\s+\S+\s+extended\s+(permit|deny)\s+(\S+)\s+(\S+)(?:\s+(\S+))?\s+(\S+)(?:\s+(eq|range|lt|gt)\s+([\d ]+))?/i
    );
    if (!m) continue;
    const [, action, proto, srcToken, srcWild, dstToken, portKeyword, portVal] = m;

    let src = 'any', dst = 'any';
    if (srcToken === 'any') {
      src = 'any';
      if (srcWild === 'host') {
        dst = { net: dstToken, len: 32 };
      } else {
        dst = parseSrcDst(srcWild || dstToken);
      }
    } else if (srcToken === 'host') {
      src = { net: srcWild, len: 32 };
      dst = parseSrcDst(dstToken);
    } else if (srcToken.match(/^\d/)) {
      const nextToken = srcWild || '';
      if (nextToken.match(/^\d/)) {
        src = { net: srcToken, len: wildcardToLen(nextToken) };
        dst = parseSrcDst(dstToken);
      } else {
        src = cidrToNet(srcToken);
        dst = parseSrcDst(srcWild);
      }
    } else {
      src = 'any';
      dst = parseSrcDst(srcWild || dstToken);
    }

    rules.push({
      action: action.toLowerCase(),
      proto: proto.toLowerCase(),
      src, dst,
      dstPort: portSpec(portKeyword, portVal),
      name: '',
    });
  }
  return rules;
}

function parseIOS(text) {
  const rules = [];
  for (const line of text.split('\n')) {
    const m = line.trim().match(
      /^(?:\d+\s+)?(permit|deny)\s+(\S+)\s+(\S+)(?:\s+(\S+))?\s+(\S+)(?:\s+(eq|range|lt|gt)\s+([\d ]+))?/i
    );
    if (!m) continue;
    const [, action, proto, srcToken, srcWild, dstToken, portKeyword, portVal] = m;
    if (srcToken.startsWith('access-list')) continue;

    let src, dst;
    if (srcToken === 'any') {
      src = 'any';
      dst = parseSrcDst(srcWild || dstToken);
    } else if (srcToken === 'host') {
      src = { net: srcWild, len: 32 };
      dst = parseSrcDst(dstToken);
    } else if (srcToken.match(/^\d/)) {
      if (srcWild && srcWild.match(/^\d/)) {
        src = { net: srcToken, len: wildcardToLen(srcWild) };
        dst = parseSrcDst(dstToken);
      } else {
        src = cidrToNet(srcToken);
        dst = parseSrcDst(srcWild);
      }
    } else {
      continue;
    }
    rules.push({ action: action.toLowerCase(), proto: proto.toLowerCase(), src, dst,
      dstPort: portSpec(portKeyword, portVal), name: '' });
  }
  return rules;
}

function parsePaloAlto(text) {
  const rules = [];
  const ruleRe = /"([^"]+)"\s*\{([^}]+)\}/gs;
  let m;
  while ((m = ruleRe.exec(text)) !== null) {
    const name = m[1];
    const body = m[2];
    const get = (key) => {
      const rm = body.match(new RegExp(key + '\\s*\\[([^\\]]+)\\]'));
      return rm ? rm[1].trim().split(/\s+/) : ['any'];
    };
    const actionM = body.match(/action\s+(allow|deny|drop)/i);
    if (!actionM) continue;
    const action = actionM[1].toLowerCase() === 'allow' ? 'permit' : 'deny';
    const src = parseSrcDst(get('source')[0]);
    const dst = parseSrcDst(get('destination')[0]);
    const svcs = get('service');
    const dstPort = svcs.length === 1 ? serviceToPort(svcs[0]) : 'any';
    rules.push({ action, proto: 'ip', src, dst, dstPort, name });
  }
  return rules;
}

function parseFortigate(text) {
  const rules = [];
  const blocks = text.split(/\bedit\s+\d+/).slice(1);
  for (const block of blocks) {
    const get = (key) => {
      const m = block.match(new RegExp('set\\s+' + key + '\\s+"?([^"\\n]+)"?'));
      return m ? m[1].trim() : null;
    };
    const actionRaw = get('action');
    if (!actionRaw) continue;
    const action = actionRaw === 'accept' ? 'permit' : 'deny';
    const srcRaw = get('srcaddr') || 'all';
    const dstRaw = get('dstaddr') || 'all';
    const svcRaw = get('service') || 'ALL';
    const name  = get('name') || '';
    const src = parseSrcDst(srcRaw === 'all' ? 'any' : srcRaw);
    const dst = parseSrcDst(dstRaw === 'all' ? 'any' : dstRaw);
    const dstPort = serviceToPort(svcRaw.split(' ')[0]);
    rules.push({ action, proto: 'ip', src, dst, dstPort, name });
  }
  return rules;
}

function parsePolicy(text, fmt) {
  if (fmt === 'ios')       return parseIOS(text);
  if (fmt === 'palo')      return parsePaloAlto(text);
  if (fmt === 'fortigate') return parseFortigate(text);
  return parseASA(text);
}

// ── Shadow / duplicate detection ──────────────────────────────────────────

function networkContains(a, b) {
  if (a === 'any') return true;
  if (b === 'any') return false;
  if (typeof a === 'string') { a = cidrToNet(a); }
  if (typeof b === 'string') { b = cidrToNet(b); }
  if (a.len > b.len) return false;
  const maskA = prefixMask(a.len);
  return (ipToInt(a.net) & maskA) === (ipToInt(b.net) & maskA);
}
function portContains(a, b) {
  if (a === 'any') return true;
  if (b === 'any') return false;
  return a.from <= b.from && a.to >= b.to;
}
function protoContains(a, b) {
  return a === 'ip' || a === 'any' || a === b;
}
function ruleEquals(a, b) {
  return (
    a.action === b.action && a.proto === b.proto &&
    JSON.stringify(a.src) === JSON.stringify(b.src) &&
    JSON.stringify(a.dst) === JSON.stringify(b.dst) &&
    JSON.stringify(a.dstPort) === JSON.stringify(b.dstPort)
  );
}
function shadows(early, late) {
  return (
    protoContains(early.proto, late.proto) &&
    networkContains(early.src, late.src) &&
    networkContains(early.dst, late.dst) &&
    portContains(early.dstPort, late.dstPort)
  );
}
function isPermissive(rule) {
  return rule.src === 'any' && rule.dst === 'any' && rule.dstPort === 'any' && rule.action === 'permit';
}

function detectIssues(rules) {
  const issues = rules.map(() => []);
  for (let j = 0; j < rules.length; j++) {
    if (isPermissive(rules[j]))
      issues[j].push({ type: 'perm', msg: 'Permits all source, all destination, all ports' });
    for (let i = 0; i < j; i++) {
      if (ruleEquals(rules[i], rules[j])) {
        issues[j].push({ type: 'dup', msg: `Duplicate of rule ${i + 1}` });
        break;
      }
      if (shadows(rules[i], rules[j])) {
        issues[j].push({ type: 'shadow', msg: `Shadowed by rule ${i + 1} — this rule is unreachable` });
        break;
      }
    }
  }
  return issues;
}

// ── Render ────────────────────────────────────────────────────────────────

function fmtNet(n) {
  if (n === 'any') return '<em>any</em>';
  if (typeof n === 'object' && n.len !== undefined)
    return n.len === 32 ? n.net : `${n.net}/${n.len}`;
  return String(n);
}
function fmtPort(p) {
  if (p === 'any') return '<em>any</em>';
  if (p.from === p.to) return String(p.from);
  return `${p.from}–${p.to}`;
}

function renderResults(rules, issues) {
  const tbody = document.getElementById('policyTableBody');
  tbody.innerHTML = '';

  let nShadow = 0, nDup = 0, nPerm = 0;

  rules.forEach((rule, i) => {
    const ruleIssues = issues[i];
    const hasShadow = ruleIssues.some(x => x.type === 'shadow');
    const hasDup    = ruleIssues.some(x => x.type === 'dup');
    const hasPerm   = ruleIssues.some(x => x.type === 'perm');
    if (hasShadow) nShadow++;
    if (hasDup)    nDup++;
    if (hasPerm)   nPerm++;

    const tr = document.createElement('tr');
    tr.className = [
      `action-${rule.action}`,
      hasShadow ? 'issue-shadow' : hasDup ? 'issue-dup' : hasPerm ? 'issue-perm' : '',
    ].join(' ').trim();

    const badgeHtml = ruleIssues.map(issue => {
      const cls = issue.type === 'shadow' ? 'badge-shadow' : issue.type === 'dup' ? 'badge-dup' : 'badge-perm';
      const lbl = issue.type === 'shadow' ? 'SHADOWED' : issue.type === 'dup' ? 'DUPLICATE' : 'PERMISSIVE';
      return `<span class="badge ${cls}" title="${issue.msg}">${lbl}</span>`;
    }).join('');

    tr.innerHTML = `
      <td>${i + 1}</td>
      <td style="font-weight:600;color:${rule.action === 'permit' ? '#15803d' : '#dc2626'}">${rule.action.toUpperCase()}</td>
      <td>${rule.proto}</td>
      <td>${fmtNet(rule.src)}</td>
      <td>${fmtNet(rule.dst)}</td>
      <td>${fmtPort(rule.dstPort)}</td>
      <td style="font-family:sans-serif;font-size:12px;">${rule.name || ''}</td>
      <td>${badgeHtml}</td>`;
    tbody.appendChild(tr);
  });

  document.getElementById('summaryDiv').innerHTML = `
    <div>
      <div class="summary-card ${rules.length > 0 ? 'card-info' : 'card-warn'}">
        <div class="card-num">${rules.length}</div>
        <div class="card-lbl">Total Rules</div>
      </div>
      <div class="summary-card ${nShadow > 0 ? 'card-danger' : 'card-ok'}">
        <div class="card-num">${nShadow}</div>
        <div class="card-lbl">Shadowed</div>
      </div>
      <div class="summary-card ${nDup > 0 ? 'card-warn' : 'card-ok'}">
        <div class="card-num">${nDup}</div>
        <div class="card-lbl">Duplicate</div>
      </div>
      <div class="summary-card ${nPerm > 0 ? 'card-danger' : 'card-ok'}">
        <div class="card-num">${nPerm}</div>
        <div class="card-lbl">Permissive</div>
      </div>
    </div>
    <p style="margin-top:8px;font-size:13px;color:#6b7280;">
      <strong>Shadowed:</strong> Rule is unreachable — an earlier, broader rule matches all its traffic first. &nbsp;
      <strong>Duplicate:</strong> Identical to an earlier rule. &nbsp;
      <strong>Permissive:</strong> Permits any source, any destination, all ports.
    </p>`;
}

function analyze() {
  const text = document.getElementById('policyInput').value.trim();
  if (!text) return;
  const rules = parsePolicy(text, currentFmt);
  if (rules.length === 0) {
    alert('No rules recognized. Verify the format matches the selected vendor button, or check for extra whitespace.');
    return;
  }
  const issues = detectIssues(rules);
  renderResults(rules, issues);
  document.getElementById('resultsDiv').style.display = 'block';
}
window.analyze = analyze;

})();
</script>