Juniper : Netscreen/ScreenOS to HTML (ns2html) + audit your firewall config (nipper)
Author: Peter Van Eeckhoutte
Add this post to Your Favorite Posts | Print This Post
| A short while ago, I came across 2 really nice tools that will help
- visualizing screenos configs into html pages
- auditing firewall configs
Converting screenos to html
The first tool, called ns2html, was developed by Rodrigo Pace de Barros and can be found at http://ns2html.sourceforge.net/
It is written in perl and both the .pl and the compiled version are part of the download package.
After downloading and extracting the zip file (I’m using the Windows version), you need to edit the config file, which can be found in the etc folder (ns2html.cfg)
Verify the “PUBLISH” and “BROWSER” path and save the file
Next, launch the ns2html.exe file (under bin)
Select your screenos config file, verify the output directory. Click “open rulebase in browser after generation?” and click generate.
Note : if you have previously converted a config file from the same firewall before, and are saving the files in the same folder, you will be prompted to overwrite the files in the small command-line window that sits behind the window dialog. When the process is complete, you’ll get a subfolder (name of the firewall) that contains a couple of html files and images. When you open the index page (index.<date>.html), you’ll get this
Life doesn’t get much easier than this… I wish there were more awesome tools like this. This is really a great tool for people who are looking to save their rulesets in a very user-friendly & readable format.
Audit your ruleset
A second tool I would like to talk about is “nipper”. This utility was written by Ian Ventura-Whiting and can be found at http://nipper.titania.co.uk . It is a Network Infrastructure Parser (hence the name NIPper) and will provide a nice friendly report containing a really nice audit report on your config file.
The tool supports a whole range of devices : Bay Networks, Cisco IOS, Cisco ASA, Juniper Netscreen, Nortel Passport, Nokia, SonicWall, …
After downloading and extracting the “all in one” package, you will see these files :
Edit the nipper.ini file with wordpad or notepad++ and go to the Report section. Set a Company Name and save the file.
When you run nipper /? or nipper –help, you’ll get a short help text :
_ ____
_ __ (_)_ __ _ __ ___ _ __ / ->/|
| '_ \| | '_ \| '_ \ / _ \ '__| /<-_/ |
| | | | | |_) | |_) | __/ | | | /
|_| |_|_| .__/| .__/ \___|_| |___|/
|_| |_|
CLI Version 0.12.0
http://nipper.titania.co.uk
Copyright (C) 2006-2008 Ian Ventura-Whiting
Nipper is a Network Infrastructure Configuration Parser. Nipper takes
a network infrastructure device configuration, processes the file and
produces a report which can include detailed a security audit and a
configuration report.
By default, input is retrieved from stdin and is output (in HTML format)
to stdout.
Command:
nipper [Options]
General Options:
--input=<file>
Specifies a device configuration file to process. For CheckPoint
Firewall-1 configurations, the input should be the conf directory
(or the database directory).
--output=<file> | --report=<file>
Specified an output file for the report.
--version
Displays the program version.
Example:
The example below will process a Cisco IOS-based router
configuration file called ios.conf and output the report to a file
called report.html.
nipper --ios-router --input=ios.conf --output=report.html
For additional help:
--help[=<topic>]
Show the online help or show the additional help on the topic
specified. The help topics are; GENERAL, DEVICES, DEVICES-ADV,
SNMP, REPORT, REPORT-ADV, REPORT-SECT, REPORT-HTML, REPORT-LATEX,
AUDIT-ACL, AUDIT-PASS, AUDIT-ADV or CONFIG-FILE.
|
Copy the screenos (or other compatible) config file into the folder and run
nipper –input=yourconfigfile.cfg –output=firewallaudit.html
If the tool has difficulties determining the type of device, you can specify the device using one of the following parameters :
CMD Option Device Type
====================================================
--auto Auto-Detect Device (Default)
--3com-firewall 3Com SuperStack 3 Firewall
--accelar Bay Networks Accelar
--cp-firewall CheckPoint Firewall Module
--cp-management CheckPoint Management Module
--ios-router Cisco IOS-based Router
--ios-catalyst Cisco IOS-based Catalyst Switch
--pix Cisco PIX-based Firewall
--asa Cisco ASA-based Firewall
--fwsm Cisco FWSM-based Router
--catos Cisco CatOS-based Catalyst
--nmp Cisco NMP-based Catalyst
--css Cisco Content Services Switch
--procurve HP ProCurve Switches
--screenos Juniper NetScreen Firewall
--nokiaip Nokia IP Firewall
--passport Nortel Passport Device
--nortel-switch Nortel Ethernet Routing Switch 8300
--sonicos SonicWall SonicOS Firewall
|
Try it – you’ll love it.
© 2009, Peter Van Eeckhoutte. All rights reserved. Terms of use are applicable to this document.
Posted in 
Tags: Related Posts:
- Lincoln on CORELAN-10-061 – Integard Home and Pro v2 Remote HTTP Buffer Overflow Exploit September 7, 2010
- Lincoln on CORELAN-10-060 – 123 Flash Chat ver 7.8 August 16, 2010
- Sud0 on CORELAN-10-059 – Sopcast Unicode BOF Remote Exploit August 10, 2010
- MaRkO T. on CORELAN-10-058 – ActiTime2 0MA CSRF July 11, 2010
- MaRkO T. on CORELAN-10-057 – Oracle BPM Process Administrator 5.7-6.0-10.3 MPs XSS July 11, 2010
- chap0 on CORELAN-10-056 - Hero DVD Remote Buffer Overflow Exploit July 7, 2010
- MaRkO T. on CORELAN-10-055 – MemDb (Multiple Remote Dos) June 28, 2010
- chap0 on CORELAN-10-054 - GSM sms Utility SEH Buffer Overflow June 28, 2010
- TecR0c on CORELAN-10-053 – FieldNotes 32 v5.00 SEH exploit June 25, 2010
- sinn3r on CORELAN-10-052 – NO-IP Domain Update Client (DUC) "Request" Insecure Encoding Algorithm June 24, 2010