No More Carve-Outs: Managing and Auditing More of Your Network in One Place

More of your network, managed in one place 

Stormshield. Stormshield Network Security firewalls are widely deployed across European defense, government, and critical infrastructure, and until now, those networks sat outside Tufin. Not anymore: you now get full policy visibility, compliance checks, change tracking, topology, and automated access requests. Support works with TOS 5.2.0 and above. 

Broadcom NSX VCF 9.1. Broadcom requires its customers to migrate to VMware Cloud Foundation (VCF), and until now, upgrading to NSX 9 meant losing Tufin policy management on those devices. That trade-off is gone. Tufin now supports VCF with NSX 9.1 with full feature parity, so nothing gets left behind in the migration. 

FortiManager Cloud. Moving to FortiManager Cloud? You no longer have to choose between cloud management and Tufin. FortiGate policies managed from the cloud get the same visibility, topology, compliance, and automation you already have on-premises. 

For example: picture an energy company with three brands of firewalls: Stormshield protecting its power stations, Palo Alto in its data centers, and Fortinet in its branch offices, managed from the cloud. Getting ready for an audit used to mean pulling reports from each one separately and piecing them together. Now they all show up in one place, checked against the same standards and changed through the same process. 

We also made a couple of existing integrations more dependable: 

• FortiManager VDOM renaming and moves between ADOMs. Tufin now automatically detects and follows firewalls and VDOMs that are renamed or moved between ADOMs, preserving revision history, change tracking, and automation continuity. That means no more disabling and re-importing devices by hand every time someone upgrades firmware or reorganizes the hierarchy. 
• Palo Alto Panorama Target field. Tufin now reads and models the Panorama rule Target field across rule views, revision comparisons, shadowing detection, and traffic path simulation, so you see exactly which devices a rule actually applies to, with fewer false positives in cleanup and topology. 

Recertification and cleanup, without carve-outs 

Cloud and multi-vendor rules have often been left out of the standard recertification process. That meant compliance gaps and no single view of recertification across your network. That changes with 5.4. Rule recertification now covers every device Tufin supports, from cloud firewalls in AWS, Azure, and Google Cloud to SD-WAN and cloud security platforms like Zscaler. One process, one sign-off, across the whole estate. (The Rule Lifecycle Management application doesn’t support these devices yet.) 

For example: when it’s time for your quarterly rule review, the rules protecting your cloud environments now get the same review and sign-off as the firewalls in your own data center. No separate process, nothing left out. 

Cleanup gets easier in AWS, too. Last hit data and rule optimization now cover AWS Network Firewall, so you can spot unused rules and objects and clean them up without leaving Tufin. 

Compliance that goes deeper 

If you use Tufin compliance policies to define and enforce segmentation guardrails, these three updates close gaps in what they can catch: 

• Block policy by Application ID. Compliance policies already matched on Application ID in allow rules, but blocking policies were limited to service-based rules. Now blocking policies support Application ID too. If a specific application shouldn’t be allowed, you can enforce exactly that, no workarounds. 
• NGFW Security Profile and Log Forwarding Profile violations. Rules missing a Security Profile Group or a Log Forwarding Profile on NGFW devices used to go undetected unless someone reviewed rule reports by hand. Now compliance checks flag them automatically, so your audit evidence is ready without the manual digging. 
• Asset-level violations for indirect tags (Akamai Guardicore and Illumio). Compliance checks previously looked only at the tags written into a rule, so an asset carrying other tags could fall outside your segmentation guardrails without any violation being raised. Violations are now evaluated against all of an asset’s tags, catching risky access that the rule definition alone would hide. For example, a rule may allow workloads tagged “Web” to reach a database. If one of those workloads also carries a “PCI” tag, Tufin now flags it, even though the rule itself looks correct. 

Path analysis for microsegmentation got sharper, too. It now shows each Guardicore and Illumio asset’s enforcement mode, the resulting allow or block decision, and the specific rule behind it. So you can simulate full enforcement and see what would happen before you touch a single asset. 

Less manual work in the change process 

Two more updates mean fewer changes fall out of automation and land back on someone’s desk: 

• FortiManager global objects. Tufin now provisions new objects directly as global objects in FortiManager and reuses existing global objects as part of the change process. 
• IPv6 and dual stack objects in modify group. IPv6 and dual stack network objects are now supported for Check Point, and IPv6 for NSX, within the modify group workflow, so managing groups on modern networks stays inside your standard automated process. 

One estate, one process 

The common thread? Fewer exceptions. Every rule, wherever it lives, should be visible, recertified, checked for compliance, and changed through the same process. TOS 5.4 brings more of your network to that standard. 

Want to see how it applies to your environment? Book a demo with our team.