Every vendor, read its own way.
PathMRI does not run one parser over everything. Each platform is read through its own API or CLI, and modelled the way that platform actually decides — because a rule that matches the post-NAT destination on one vendor matches the pre-NAT destination on the next.
Firewall appliances
| Vendor | How PathMRI reads it | What it evaluates |
|---|---|---|
| Cisco ASA | HTTPS /admin/exec/, falling back to SSH | ACLs, interfaces and NAT; IPsec crypto maps and VTI tunnels |
| Fortinet FortiGate | FortiOS REST API v2, falling back to SSH | Policies, address and service objects, NAT; IPsec phase 1 / phase 2 selectors |
| Palo Alto PAN-OS | XML / REST API, falling back to SSH | Security and NAT rulebases, address and service objects, zones, interfaces, routes |
| Cisco FTD / Firepower | FDM REST API | Access-control policy and NAT — object and manual, all three sections |
| Check Point (CloudGuard / Gaia) | Management API /web_api/ | Access rulebase and NAT rulebase, objects, VPN communities and encryption domains |
| Juniper SRX (Junos) | SSH — show configuration security | Zone security policies, security nat, address book, applications, st0 tunnels |
| pfSense / OPNsense (Netgate) | SSH — config.xml | pf filter rules and NAT, interfaces, IPsec phase 1 / phase 2 and strongSwan state |
| VyOS | SSH — show configuration commands | Named rule-sets, source and destination NAT, interface addresses, site-to-site selectors |
Cloud providers
| Provider | Policy engine | Model |
|---|---|---|
| Amazon Web Services | Security Groups + Network ACLs | Stateful groups, plus stateless ordered NACLs |
| Amazon Web Services | AWS Network Firewall (managed NGFW) | Stateless rule groups and the firewall policy |
| Microsoft Azure | Network Security Groups | Subnet and NIC rules, priority-ordered allow / deny |
| Microsoft Azure | Azure Firewall (managed NGFW) | The routed appliance policy — a different model from an NSG |
| Google Cloud | VPC firewall rules | Directional, priority-ordered allow / deny |
Hosts and containers
Host firewalls
iptables, ufw and firewalld on Linux; Windows Firewall — checked per host, inbound and outbound, because the last hop is a firewall too.
Kubernetes, agentless
Live cluster map, path analyzer, reachability matrix, exposure scan, egress and DNS checks, overlay proof and drift — all over SSH, leaving nothing on the nodes.
NetworkPolicy, plus ordered Calico and Cilium.
Docker
Container networks, published ports and bridge masquerade modelled with the same declared-versus-observed NAT contract every other vendor uses.
What each one is worth reading about
Every vendor has a chapter in the manual: what is read, what is evaluated, how far NAT and VPN support goes, and what is deliberately not asserted.