Firewalls and WAFs
Connected security devices give Garrison their policy and configuration. It keeps a history of every configuration it pulls, shows drift from a baseline you set, and lets Garry propose changes such as blocking an address. Changes run only after approval.
| Device | Status | What Garrison does |
|---|---|---|
| Fortinet FortiGate | Available | Pulls policy and config, tracks drift; block or unblock an IP; roll back everything Garrison added |
| Cloudflare WAF | Available | Pulls the zone’s custom rules; block an IP (in count mode first, then promote to block), unblock, roll back |
| AWS WAF | Available | Pulls web ACLs and IP sets; the same count-first block, unblock and roll back |
| Palo Alto, Check Point, pfSense, F5 Advanced WAF | Planned |
Connect
Section titled “Connect”Open Firewalls & WAFs and click Connect a device (or Connections → Firewalls & WAFs).
FortiGate
Section titled “FortiGate”| Field | Notes |
|---|---|
| Management URL | For example https://fortigate.example.internal |
| REST API token | Create a REST API admin on the FortiGate. Read-only is enough until you want Garrison to make approved blocks |
| VDOM | Optional; root when empty |
Allow the appliance’s address as a trusted host for that API admin.
Cloudflare WAF
Section titled “Cloudflare WAF”An API token with Zone WAF: Read (and Edit, for approved rules), and the zone ID.
AWS WAF
Section titled “AWS WAF”An access key, the region, the scope (REGIONAL, or CLOUDFRONT for CloudFront distributions)
and the web ACL name.
Baseline and drift
Section titled “Baseline and drift”
Open a device and, once its configuration is how you want it, click Set baseline. Every later pull is compared with the baseline; a difference shows as Drift on the device, with a diff of exactly what changed.
Changes
Section titled “Changes”Ask Garry (“block 203.0.113.50 on the FortiGate”) or act from a case. Garrison proposes the change, showing the exact objects and rules it will create, and runs it only after it is approved under Approvals. After running it, Garrison reads the device back to verify the change took effect.
On the WAFs a block starts in count mode: the rule only counts matching requests, so you can check it would not block real users, then Promote to block. Everything Garrison creates is named so that Roll back removes exactly its own objects and nothing else.