Tufin Orchestration Suite

Managing firewall rules is easy, and all users can raise tickets, with usage frequency tracked. Predefined tasks can be auto-approved, and integration into your environment is simple. Implementing rules is a one-click process that used to take minutes. Customer support is great when issues arise. There's not much to dislike; it significantly reduces your security team's workload. What would typically require at least five people can now be handled by one engineer operating Tufin.

The automation of firewall rule provisioning and support for various platforms are great. However, support seems understaffed. It helps me identify accurate network paths between endpoints in a vast enterprise network.

This tool is excellent for reviewing, auditing, and reporting on policies, and maintaining best practices across your security infrastructure. SecureChange simplifies operations by automating daily tasks. After Aurora, the tool has additional features but requires more resources; it can become slow with large data sets. Overall, it aids in audit, compliance, and firewall policy cleanup, and SecureChange reduces manual daily work.

For large organizations handling numerous daily ACL requests and managing multiple firewall vendors, Tufin (NSPM) is highly valuable. The newer Aurora platform demands significant integration effort, but Tufin support is supportive throughout setup and maintenance. My experience has been mostly platform-related, but I've learned a lot about its features—it's a great addition. However, for large companies with legacy network devices, you'll face many setup differences and have to run separate scripts provided by Tufin. That said, Tufin works closely with you to maintain standards and deploy needed configurations. We use it for daily firewall rule workflow automation, which has made processing requests faster and easier.

It integrates with any ticketing tool through API and offers a wide range of features to suit your environment. Customer support is excellent, and the GUI is user-friendly. The licensing cost is a downside, as are the limited out-of-the-box integrations and the sometimes lengthy development time for feature requests. If you connect all your security devices like routers, firewalls, and switches, Tufin automatically builds your network topology—a standout feature.

SecureTrack is the premier module for policy orchestration, automating rules and policies to lighten admin workload. SecureChange is also great for scheduling changes. I don't have major negatives, but when monitoring traffic, it displays ports when integrated with Palo Alto; it would be beneficial to show application-based traffic. We use it to monitor any-any rules, get recommendations, and create specific rules to allow only necessary traffic, thereby securing our network rather than leaving wide-open rules.

SecureChange is a lifesaver for me—it drastically simplifies my daily tasks and saves considerable time. The best indicator of how much we value it is when it's down; my team constantly urges me to fix it immediately. The main drawback is troubleshooting: the product is complex, and even Tufin support sometimes struggles to resolve issues quickly, often sending knowledge base articles instead of scheduling direct investigation sessions, which delays resolution. On the plus side, Tufin saves hours on policy implementation, keeps policies optimized and tidy—something we couldn't achieve otherwise—and provides connectivity mapping (SecureTrack's MAP) invaluable for our large, complex network. It also helps me keep pending firewall change requests near zero, which was impossible before we adopted it and led to constant business complaints.

This tool is fantastic for simplifying firewall rule pushes across many device types. It offers great customization, including user access limits and tailored workflows in SecureChange, plus the ability to define zone-based policies where you choose what gets auto-approved or held for manual review before deployment. You can also deny requests if needed. Whether you're implementing it in an existing environment or starting fresh, you control how much automation you adopt. Initially, you might just use it to monitor firewalls and handle tickets manually outside the system. When ready, you can enable automated approvals gradually. Keeping it up to date is straightforward, and if upgrades encounter issues, rollback is easy or you can rely on Tufin's excellent support. A potential downside is that connecting intermediate routers requires a license, which can be pricey. For networks with many routers purely routing, you might need to update 'generic devices' in Tufin to keep topology accurate. Overall, it accelerates daily firewall provisioning tasks.

The product is straightforward to use and easy to set up initially. However, integrating it with cloud services is challenging, and the firewall design proposals need careful review. Also, creating rules on the firewall side requires attention.

The standout feature of this suite is how it centralizes firewall policy management across multiple vendors, simplifying intricate network security operations. Automated policy analysis, risk evaluation, and change workflows cut down manual work considerably while boosting compliance and reducing errors. The clear view of network topology and policies speeds up troubleshooting and policy implementation. That said, initial setup and configuration can be lengthy, particularly in large, multi-vendor environments. Some advanced capabilities require a learning curve and experience to use properly. Additionally, certain integrations and feature improvements could be expanded to further reduce manual effort and increase flexibility. Overall, this tool has streamlined our firewall policy management, automated security change requests, and helped us maintain compliance across our multi-vendor network. Better visibility into policies has reduced manual work and accelerated policy deployment while minimizing misconfigurations. As a result, our team responds faster, operates more efficiently, and has strengthened our security posture.