Firewall Rules With Two Owners: Tracing Recurring Reverts

When a firewall rule keeps reverting to a previous state and two administrators both have edit rights, the first step is to find out who changed it last and when. Use the firewall’s audit log or change log to identify the exact time of each revert, then cross-reference that with the admin accounts and any automated configuration management tools. If the logs show no human action at the revert time, the cause is almost certainly a scheduled job or a configuration sync pulling an older version of the rule.

Why Firewall Rules Revert

A firewall rule is a line in a configuration file that tells the firewall what traffic to allow or block. When two people have administrative access, each can edit that file. A revert happens when the file is overwritten with an older version, undoing the most recent change. Common causes include:

• An administrator manually re-entering an old rule from memory or a local backup.
• A configuration management tool (like Ansible, Puppet, or a vendor’s own orchestration) pushing a stored template that does not include the new rule.
• A scheduled backup-and-restore job that restores the config from a snapshot taken before the change.
• Two admins editing simultaneously, where the last save wins and one save is based on an outdated copy.
• A high-availability pair where the active unit syncs its config to the standby, and the standby has an older version.

Step-by-Step Tracing Process

To trace a recurring revert, follow this order. It works for most enterprise firewalls (Cisco ASA, Palo Alto, Fortinet, Check Point, and open-source pfSense/OPNsense).

1. Check the audit log first. Look for configuration changes, not just traffic logs. Filter by the rule name or object name. Note the timestamp of every change and every revert.
2. Identify the admin account. The log should show which user made the change. If it says “admin” or “system,” that points to an automated process or a shared account.
3. Look for configuration sync events. If you have a high-availability pair, check if the revert time matches a sync from the peer. Many firewalls log “config sync” or “HA sync” separately.
4. Check external management tools. If you use a central management platform (like Panorama, FortiManager, or a cloud-based orchestrator), check its change log. It often has its own schedule for pushing configs.
5. Review scheduled jobs on the firewall itself. Some firewalls allow scheduled config reloads or script execution. Look for any job that runs at the revert time.
6. Compare the reverted rule to known versions. If you have config backups, diff the current config against the backup taken just before the revert. This tells you exactly what changed.

How to Pinpoint the Owner of a Revert

When the audit log shows a human admin, the tracing is straightforward: that admin made the change. But when two admins share a role, the log may show both names at different times, and the revert could be an accidental overwrite. Here is how to narrow it down:

• Look for a pattern: does the revert happen at the same time every day, or after a specific admin logs in?
• Check if the admin who made the original change also made the revert. Sometimes an admin edits a rule, then later edits a different rule from a cached page, and the firewall saves the entire config, reverting the first rule.
• If the log shows “system” or “scheduler,” it is not a human. Check the system’s own scheduled tasks.
• If you have a change management ticket system, cross-reference the timestamps with ticket activity. The admin who closed a ticket right before the revert is a suspect.

Common Pitfalls and Misconceptions

A frequent misconception is that the firewall’s audit log always records every change. In reality, some changes made via the CLI (command line interface) may not appear in the GUI audit log, or the log may only show that a change occurred, not who made it. Another pitfall is assuming that a revert is malicious. It is usually accidental, caused by a stale browser tab or a script that pushes an old config.

Another common issue: when two admins are editing at the same time, the firewall’s web interface may not lock the config. The last one to click “Save” wins, and the other admin’s changes are silently lost. This looks like a revert, but it is actually a lost update. The audit log will show two saves close together, with the second one overwriting the first.

Preventing Recurring Reverts

Once you have traced the cause, you can prevent it from happening again. The most effective measures are:

• Use role-based access control (RBAC) to give each admin a unique account, and restrict who can edit firewall rules. Do not share a generic admin account.
• Enable configuration locking or “admin lock” on the firewall. Many firewalls have a setting that prevents simultaneous edits.
• If you use a central management tool, make sure its configuration template is the single source of truth. Update the template first, then push to the firewall.
• Schedule a regular config backup and compare it to the current config. If a revert happens, you can restore the correct version quickly.
• For high-availability pairs, ensure both units have the same config version. Sync the config after every change, and check that the standby unit is not running an older version.

Comparing Built-in Logs vs. External Tools

Most firewalls have a built-in audit log, but its detail level varies. Cisco ASA logs configuration changes in the syslog with a specific message ID. Palo Alto has a dedicated Config Change log in the web interface. Fortinet logs changes in the event log. pfSense has a settings backup and a change log if you enable it. These built-in logs are usually enough to trace a revert.

However, if you have multiple firewalls or a complex environment, an external tool like a SIEM (Security Information and Event Management) or a configuration management database (CMDB) can help. These tools collect logs from all devices in one place and can correlate changes across the network. They also provide long-term storage, while the firewall’s own log may only keep a few days or weeks.

Cost and Effort of Tracing

Tracing a revert is a time-consuming task, but it does not require expensive tools. The built-in logs are free. The main cost is the time spent searching through logs and correlating events. For a single firewall, you can usually trace a revert in 30 minutes to an hour. For a large network with many firewalls and a central management platform, it may take a day or more, especially if logs are not centralized.

If you do not have a log management system, you may need to enable logging on the firewall first. Some firewalls have logging disabled by default for configuration changes, so you may not have historical data. In that case, you will need to wait for the next revert and catch it in real time.

Frequently Asked Questions

Q: How do I find out who changed a firewall rule last?

Go to the firewall’s audit or change log and filter by the rule name or the object it references. The log will show the username, timestamp, and the action (add, edit, delete). If the log is empty, check if config logging is enabled; if not, you cannot see past changes.

Q: What if the audit log shows no user for the revert?

That means the change was made by a system process, not a human. Check scheduled tasks on the firewall, and check any external management tool or script that might push configs. Also check if the firewall is part of a high-availability pair where the peer syncs config.

Q: Can two admins edit the firewall at the same time?

Yes, unless the firewall has a configuration lock. Most firewalls allow concurrent sessions, and the last save wins. This can cause a revert if one admin saves an older version of the config. Enable the admin lock feature if available.

Q: How do I stop a configuration management tool from reverting my changes?

Update the tool’s stored configuration to include your new rule. If you use Ansible, edit the playbook or the template file. If you use a vendor’s management platform, make the change in the platform and push it to the firewall. Never edit the firewall directly if a central tool manages it.

Q: Is it possible that the firewall itself is reverting the rule?

Yes, if the firewall has a scheduled config reload from a backup or a script. Some firewalls have a “revert to last known good config” feature that triggers after a failed commit. Check the system logs for any error or rollback event around the revert time.

Q: What should I do if I cannot find the cause?

Enable detailed configuration logging, set up a syslog server to store logs externally, and wait for the next revert. When it happens, immediately check the logs and the running config. Also, review any scripts or scheduled jobs that run on the firewall or on any management server.

Related

• Ethernet and Powerline Not Needed With This Cable?
• Palworld 1.0 Infinite Resource Farming with Multi-Base Setups
• Directory Listing: What It Is & How It Works