firewall-config-diff

Parse each raw config with the matching parsing skill (Cisco, Fortinet, Palo Alto, or SRX) to produce the intermediate schema, then diff the two schemas. Cross-vendor constructs like zones versus security-levels are normalized before pairing, and features with no equivalent are flagged not-comparable.

Treat the older config as side A and the newer as side B, then run the semantic diff. Same-vendor pairs can anchor by stable object names, so value changes report as changed rather than added plus removed, and rule-order changes are reported separately.

Raw configs are accepted, but each raw side is first parsed by the matching vendor parsing skill into the intermediate schema before comparison. The diff itself never re-implements parsing and never compares raw text line by line.

A line diff flags every rename, reorder, and syntax variation as a change while missing that two differently-named objects describe the same subnet. Semantic comparison pairs items by value and match-and-action tuple, so only meaningful differences surface.

Features with no cross-vendor equivalent, such as Cisco ASA security-level trust ordering or UTM profile contents, are flagged not-comparable and excluded from the added/removed/changed counts. They are listed in the report but never counted as false differences.

No. Secrets such as PSKs, certificates, and passwords are never printed. The comparison reports only a presence or changed flag, for example noting that a PSK changed, without exposing any secret value.