feat(importer): add generic firewall import

documentation/revision-history.md

@@ -545,3 +545,20 @@ This PR hardens FWO installation and security-sensitive workflows. It restricts
 - Support for writing firewall configurations via templates
 - A template provider (Tufin or custom templates) must be configured before use
 - FW config change external workflow is only active after explicit assignment per management and change category in the settings
+
+## 9.2.0 - 10.07.2026 MAIN
+This release makes FWO compatible with the following operating systems:
+- Ubuntu 22.04 and 24.04
+- Debian 11 & 12
+- Red Hat 9 (new - tested with v9.8)
+- Rocky 9 (new - tested with v9.8)
+- Ubuntu 26.04 (new)
+- Debian 13 (new)
+
+Not supported any longer are:
+- Ubuntu <  22.04
+- Debian <  11
+
+## 9.2.1 - 10.07.2026
+- add generic firewall import
+- enable azure2022ff for normalized config import

inventory/group_vars/all.yml

@@ -1,5 +1,5 @@
 ### general settings
-product_version: "9.2.0"
+product_version: "9.2.1"
 ansible_user: "{{ lookup('env', 'USER') }}"
 ansible_become_method: sudo
 ansible_python_interpreter: /usr/bin/python3

roles/database/files/sql/creation/fworch-fill-stm.sql

@@ -465,20 +465,20 @@ insert into stm_track (track_id,track_name) VALUES (24,'extended log'); -- check
 --     VALUES (2,'Netscreen','5.x-6.x','Netscreen', '', true,false);
 -- insert into stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufacturer,dev_typ_predef_svc,dev_typ_is_mgmt,is_pure_routing_device)
 --     VALUES (4,'FortiGateStandalone','5ff','Fortinet','', true,false);
-insert into stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufacturer,dev_typ_predef_svc,dev_typ_is_mgmt,is_pure_routing_device)
-    VALUES (5,'Barracuda Firewall Control Center','Vx','phion','',true,false);
-insert into stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufacturer,dev_typ_predef_svc,dev_typ_is_mgmt,is_pure_routing_device)
-    VALUES (6,'phion netfence','3.x','phion','', false,false);
+insert into stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufacturer,dev_typ_predef_svc,dev_typ_is_multi_mgmt,dev_typ_is_mgmt,is_pure_routing_device)
+    VALUES (5,'Barracuda Firewall Control Center','Vx','phion','',false,true,false);
+insert into stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufacturer,dev_typ_predef_svc,dev_typ_is_multi_mgmt,dev_typ_is_mgmt,is_pure_routing_device)
+    VALUES (6,'phion netfence','3.x','phion','',false,false,false);
 -- insert into stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufacturer,dev_typ_predef_svc,dev_typ_is_mgmt,is_pure_routing_device)
 --     VALUES (7,'Check Point','R5x-R7x','Check Point','', true,false);
-insert into stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufacturer,dev_typ_predef_svc,dev_typ_is_mgmt,is_pure_routing_device)
-    VALUES (8,'JUNOS','10-21','Juniper','any;0;0;65535;;junos-predefined-service;simple;', true,false);
-insert into stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufacturer,dev_typ_predef_svc,dev_typ_is_mgmt,is_pure_routing_device)
-    VALUES (9,'Check Point','R8x','Check Point','', true,false);
-insert into stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufacturer,dev_typ_predef_svc,dev_typ_is_mgmt,is_pure_routing_device)
-    VALUES (10,'FortiGate','5ff','Fortinet','', false,false);
-insert into stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufacturer,dev_typ_predef_svc,dev_typ_is_mgmt,is_pure_routing_device)
-    VALUES (11,'FortiADOM','5ff','Fortinet','', true,false);
+insert into stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufacturer,dev_typ_predef_svc,dev_typ_is_multi_mgmt,dev_typ_is_mgmt,is_pure_routing_device)
+    VALUES (8,'JUNOS','10-21','Juniper','any;0;0;65535;;junos-predefined-service;simple;', false,true,false);
+insert into stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufacturer,dev_typ_predef_svc,dev_typ_is_multi_mgmt,dev_typ_is_mgmt,is_pure_routing_device)
+    VALUES (9,'Check Point','R8x','Check Point','', false,true,false);
+insert into stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufacturer,dev_typ_predef_svc,dev_typ_is_multi_mgmt,dev_typ_is_mgmt,is_pure_routing_device)
+    VALUES (10,'FortiGate','5ff','Fortinet','', false,false,false);
+insert into stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufacturer,dev_typ_predef_svc,dev_typ_is_multi_mgmt,dev_typ_is_mgmt,is_pure_routing_device)
+    VALUES (11,'FortiADOM','5ff','Fortinet','', false,true,false);
 insert into stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufacturer,dev_typ_predef_svc,dev_typ_is_multi_mgmt,dev_typ_is_mgmt,is_pure_routing_device)
     VALUES (12,'FortiManager','5ff','Fortinet','',true,true,false);
 insert into stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufacturer,dev_typ_predef_svc,dev_typ_is_multi_mgmt,dev_typ_is_mgmt,is_pure_routing_device)
@@ -515,6 +515,10 @@ insert into stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufac
     VALUES (28,'Cisco Asa','9','Cisco','',false,true,false);
 insert into stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufacturer,dev_typ_predef_svc,dev_typ_is_multi_mgmt,dev_typ_is_mgmt,is_pure_routing_device)
     VALUES (29,'Cisco Asa on FirePower','9','Cisco','',false,true,false);
+insert into stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufacturer,dev_typ_predef_svc,dev_typ_is_multi_mgmt,dev_typ_is_mgmt,is_pure_routing_device)
+    VALUES (30, 'Generic Firewall Management', '1.0', null, '', false, true, false);
+insert into stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufacturer,dev_typ_predef_svc,dev_typ_is_multi_mgmt,dev_typ_is_mgmt,is_pure_routing_device)
+    VALUES (31, 'Generic Firewall Gateway', '1.0', null, '', false, false, false);
 
 -- SET statement_timeout = 0;
 -- SET client_encoding = 'UTF8';

roles/database/files/upgrade/9.2.1.sql

@@ -0,0 +1,5 @@
+INSERT INTO stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufacturer,dev_typ_predef_svc,dev_typ_is_multi_mgmt,dev_typ_is_mgmt,is_pure_routing_device)
+VALUES
+    (30, 'Generic Firewall Management', '1.0', null, '', false, true, false),
+    (31, 'Generic Firewall Gateway', '1.0', null, '', false, false, false)
+ON CONFLICT (dev_typ_id) DO NOTHING;

roles/importer/files/importer/common.py

@@ -6,10 +6,12 @@
 from pathlib import Path
 from socket import gethostname
 
+from fw_modules.azure2022ff.fwcommon import Azure2022ffCommon
 from fw_modules.checkpointR8x.fwcommon import CheckpointR8xCommon
 from fw_modules.ciscoasa9.fwcommon import CiscoAsa9Common
 from fw_modules.fortiadom5ff.fwcommon import FortiAdom5ffCommon
 from fw_modules.fortiosmanagementREST.fwcommon import FortiosManagementRESTCommon
+from fw_modules.generic.fwcommon import GenericFirewallCommon
 from fwo_const import IMPORTER_BASE_DIR
 from fwo_log import FWOLogger
 from model_controllers.fwconfig_import_rollback import FwConfigImportRollback
@@ -304,6 +306,10 @@ def get_module(import_state: ImportState) -> FwCommon:
         fw_module = CheckpointR8xCommon()
     elif pkg_name == "fortiosmanagementREST":
         fw_module = FortiosManagementRESTCommon()
+    elif pkg_name == "genericfirewallmanagement1.0":
+        fw_module = GenericFirewallCommon()
+    elif pkg_name == "azure2022ff":
+        fw_module = Azure2022ffCommon()
     else:
         raise FwoImporterError(f"import_management - no fwcommon module found for package name {pkg_name}")
 

roles/importer/files/importer/fw_modules/azure2022ff/fwcommon.py

@@ -1,3 +1,4 @@
+from fwo_log import FWOLogger
 from model_controllers.fwconfigmanagerlist_controller import FwConfigManagerListController
 from model_controllers.import_state_controller import ImportStateController
 from models.fw_common import FwCommon
@@ -7,4 +8,18 @@ class Azure2022ffCommon(FwCommon):
     def get_config(
         self, config_in: FwConfigManagerListController, import_state: ImportStateController
     ) -> tuple[int, FwConfigManagerListController]:
-        raise NotImplementedError("Azure 2022 ff is not supported yet in the new python importer.")
+
+        return get_config(config_in, import_state)
+
+
+def get_config(
+    config_in: FwConfigManagerListController, _import_state: ImportStateController
+) -> tuple[int, FwConfigManagerListController]:
+    FWOLogger.debug("starting azure2022ff/get_config")
+
+    if config_in.has_empty_config() or config_in.contains_only_native():
+        raise NotImplementedError(
+            "Azure 2022 ff import currently only supports normalized config parsing, not native config retrieval from FW-Manager."
+        )
+
+    return 0, config_in

roles/importer/files/importer/fw_modules/generic/fwcommon.py

@@ -0,0 +1,23 @@
+from fwo_log import FWOLogger
+from model_controllers.fwconfigmanagerlist_controller import FwConfigManagerListController
+from model_controllers.import_state_controller import ImportStateController
+from models.fw_common import FwCommon
+
+
+class GenericFirewallCommon(FwCommon):
+    def get_config(
+        self, config_in: FwConfigManagerListController, import_state: ImportStateController
+    ) -> tuple[int, FwConfigManagerListController]:
+
+        return get_config(config_in, import_state)
+
+
+def get_config(
+    config_in: FwConfigManagerListController, _import_state: ImportStateController
+) -> tuple[int, FwConfigManagerListController]:
+    FWOLogger.debug("starting generic/get_config")
+
+    if config_in.has_empty_config() or config_in.contains_only_native():
+        raise ValueError("Generic firewall import requires a normalized config as input.")
+
+    return 0, config_in