topic Re: Manage PIX ACLs ? in Network Security

Manage PIX ACLs ?

yann.boulet — Mon, 11 Mar 2019 10:11:46 GMT

Hello all,

i have a lot of rule on my V7.0 PIX and i want to know if there is a way to find an used rules in order to reduce the number of rules or maybe to know last time rules have been used or matched ?

Thank you

Re: Manage PIX ACLs ?

Jon Marshall — Thu, 10 May 2007 08:47:00 GMT

If you do a "sh access-list" from enable mode you should see the hit count at the end of the line eg:

access-list from_prod1 line 1 permit tcp object-group prod_machines host 10.228.56.2 eq telnet

access-list from_prod1 line 1 permit tcp host 10.228.51.51 host 10.228.56.2 eq telnet (hitcnt=12)

access-list from_prod1 line 1 permit tcp host 10.230.24.77 host 10.228.56.2 eq telnet (hitcnt=0)

access-list from_prod1 line 1 permit tcp host 10.181.66.12 host 10.228.56.2 eq telnet (hitcnt=0)

access-list from_prod1 line 1 permit tcp host 10.228.50.95 host 10.228.56.2 eq telnet (hitcnt=0)

access-list from_prod1 line 2 permit tcp object-group prod_machines host 10.228.56.3 eq telnet

So only the first line in the above access-list has any hits.

You can reset the counters by using the

"clear access-list counters"

HTH

Jon

Re: Manage PIX ACLs ?

yann.boulet — Thu, 10 May 2007 10:33:52 GMT

Thanks for your help, just another question, do you know if it's possible to transform names in the configuration to ip addresses, i don't remember how to do it it's just be sure of the ip addresses when i use "sh access-list"

thanks

Re: Manage PIX ACLs ?

Jon Marshall — Thu, 10 May 2007 10:40:23 GMT

If i understand correctly i'm not sure you can do this. You can do a "sh names" and then cross reference with the access-list but i don't know of a way to transpose the ip address instead of the name in a "sh access-list"

Hope i haven't misunderstood.

Jon

Re: Manage PIX ACLs ?

mark.j.hodge — Thu, 10 May 2007 11:17:00 GMT

There should be an entry in your configureation

"names"

if you run the command

"no names"

then all address to name translations will be turned off. This will *not* remove the name entries so you can turn it back on again without a problem.

** Please rate posts if helpful **

Re: Manage PIX ACLs ?

laurent.geyer — Thu, 10 May 2007 13:45:49 GMT

This might be more useful if you do a `sh access-list | i hitcnt=0'.

That way you can sort out the rules that haven't received any hits over a certain time fram.