Firewall audit products are maturing, but the product class is still a relatively young, small market. Take both present and future needs into account. Measure the tool’s capabilities and cost against your environment. Don’t buy more than you need and don’t overlook scalability. Some products offer regulation-specific reports, usually for PCI DSS, which may be useful. Forrester Research: Put these products to the test once you narrow your choices to those that claim to meet most of your requirements.”]
Source: https://www.csoonline.com/article/2125166/firewall-audit-dos-and-don-ts.html