topic Re: ASA removing ACL lines in Network Security

ASA removing ACL lines

Steven Williams — Fri, 21 Feb 2020 14:21:30 GMT

So I am in this dilema where the person before me configured our internet ASA using all ASDM, so its hard to figure out what is what in the CLI since all I see is DM_INLINE_blah.

for example:

access-list INSIDE_access_in line 15 extended permit object-group DM_INLINE_SERVICE_6 object-group DM_INLINE_NETWORK_9 any log informational interval 300 0x0aef5baa
access-list INSIDE_access_in line 15 extended permit tcp 10.0.0.0 255.0.0.0 any eq 1935 log informational interval 300 (hitcnt=2013) 0x8fb5bf4b
access-list INSIDE_access_in line 15 extended permit tcp ALL_172.16 255.255.0.0 any eq 1935 log informational interval 300 (hitcnt=0) 0x4f0c2f97
access-list INSIDE_access_in line 15 extended permit tcp ALL_172.26 255.255.0.0 any eq 1935 log informational interval 300 (hitcnt=0) 0x6e98f459
access-list INSIDE_access_in line 15 extended permit tcp 192.168.0.0 255.255.0.0 any eq 1935 log informational interval 300 (hitcnt=0) 0xb2262918

As you can see some lines do not have hit counts and I want to remove them. Can I do this line by line or is going to mess something up?

Can I do a "no access-list INSIDE_access_in line 15 extended permit tcp 192.168.0.0 255.255.0.0 any eq 1935"and have it take out that one line only?

Oh to make it better this is Code 8.2 🙂

Re: ASA removing ACL lines

Spooster IT Services — Mon, 25 Sep 2017 13:30:39 GMT

Hi Steven,

Run the following command to check which subnets are there in the object-group:

show run object-group id DM_INLINE_NETWORK_9

Then remove those are not required as below:

object-group network DM_INLINE_NETWORK_9

no network-object 192.168.0.0 255.255.0.0

"no" in front of network-object will remove subnet from the object, so in this way the ACL line will also be removed.

Re: ASA removing ACL lines

Steven Williams — Mon, 25 Sep 2017 13:59:33 GMT

The issue with removing the network object is that the acl has multiple ports tied to it. So while 192.168.0.0 255.255.0.0 may not be using port 80 its using port 1433 in the same ACE.

Re: ASA removing ACL lines

Spooster IT Services — Mon, 25 Sep 2017 14:02:37 GMT

Hi Steven,

In this case you need to create multiple object-group for ports and define accordingly.

But there is no way to delete a single ACE without removing subnet from object group.

Re: ASA removing ACL lines

Steven Williams — Mon, 25 Sep 2017 14:04:07 GMT

I figured as much. This is why you don't use ASDM for all your firewall configuration.