Firewall/Router Config Import — Export Guide¶

Purpose¶

Scans The firewall config parser (backend/app/core/firewall_parsers/) ingests a device's running-config to auto-populate Hosts, Scope, Findings and Credentials (see docs/modules/ARCHITECTURE.md for the enrichment pipeline). On top of the config itself, it can opportunistically extract two kinds of observed live state — data that isn't part of the config at all, but is genuinely useful for recon:

ARP table (ArpEntry: ip, mac, interface) — every host the device has actually talked to recently, whether or not it was ever scanned.
DHCP lease/client list (DhcpLease: ip, mac, hostname) — same, plus (where the vendor reports it) the client's self-announced hostname, often the richest identifying detail available for an unscanned host.

How to use it: run the vendor's config-export command as usual, then append the ARP/DHCP command's output to the same file before uploading — nothing needs to be separated or labeled, the parser looks for each command's own distinctive table header (or, for vendors whose ARP dump has no header at all, the row shape itself) anywhere in the pasted text. If you skip these commands, the config-only fields (interfaces, ACL, NAT, VLANs, users) are still parsed exactly as before — this is purely additive.

None of this is diffed against the previous upload (diff_parsed_configs only compares config, not live state) and none of it is scanned/tagged in_scope automatically — it only creates lightweight Host stubs (tag discovered-via-arp-dhcp) or enriches an existing Host's mac:... tag / blank hostname.

Per-vendor commands¶

Vendor	Config export	ARP command	DHCP-lease command
Cisco IOS/IOS-XE	`show running-config`	`show ip arp`	`show ip dhcp binding`
Cisco ASA	`show running-config`	`show arp`	`show dhcpd binding`
MikroTik RouterOS	`/export`	`/ip arp print`	`/ip dhcp-server lease print`
Huawei VRP	`display current-configuration`	`display arp`	`display dhcp server ip-in-use all`
Fortinet FortiOS	`show full-configuration`	`get system arp`	`get system dhcp lease-list <interface>`
PaloAlto PAN-OS	`set`-format export	`show arp all`	(not supported — see note below)
UniFi (EdgeOS/USG)	`config.gateway.json`	(not supported)	(not supported)
pfSense	`config.xml`	(not supported)	(not supported)

Notes:

PaloAlto: show arp all is parsed; there's no standard operational command for DHCP-server lease inspection comparable to the others (PAN-OS boxes are less commonly the DHCP server on a segment) — dhcp_leases stays empty for this vendor by design, not a bug.
UniFi / pfSense: both export structured config (JSON/XML) rather than CLI text, so there's no natural place to "paste extra CLI output" into the same file the way there is for the six CLI-based vendors above. Their controller UIs do expose client lists (UniFi: Clients page; pfSense: Status → DHCP Leases / Diagnostics → ARP Table) but wiring those up would need a second, format-specific ingestion path — not implemented yet.
Hostname availability: only MikroTik and Fortinet's DHCP-lease commands report the client's hostname in their default output; the others give ip+mac only (still enough to create/enrich a Host).

Example — Cisco IOS¶

Paste all three outputs into one file, in any order, and upload it as usual:

hostname EdgeRouter1
!
interface GigabitEthernet0/0
 ip address 203.0.113.1 255.255.255.252
!
interface GigabitEthernet0/1
 ip address 10.10.10.1 255.255.255.0
!
ip access-list extended OUTSIDE_IN
 permit ip any any
!
username admin privilege 15 password 7 0822455D0A16
!
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  10.10.10.50             23   0022.3344.5566  ARPA   GigabitEthernet0/1
Internet  10.10.10.75              -   0033.4455.6677  ARPA   GigabitEthernet0/1

IP address      Client-ID/Hardware address    Lease expiration        Type
10.10.10.50     0022.3344.5566                Mar 01 2026 12:00 AM    Automatic

The preview screen will show an "ARP entries" / "DHCP leases" count alongside the usual interfaces/ACL/NAT counts, and the "planned changes" box will report how many hosts will be newly discovered vs. enriched.

Why this is safe to paste in as-is¶

The parser never assumes ARP/DHCP output is present, and detecting it never affects vendor auto-detection (detect() only looks at config-specific markers). Extraction is a best-effort, additive scan: a row is only accepted when it clearly contains both an IP-shaped and a MAC-shaped token (firewall_parsers/util.py::extract_ip_and_mac), so ordinary config lines can't be misread as ARP/DHCP data, and malformed input just yields an empty list rather than an error.