We have an internal JSON format for specifying the firewall configurations of all our servers. Essentially just "this group of servers can access this group of servers on these ports". Together with an idempotent "make it so" script, it has been a lifesaver.