topic Re: FMC CLI command to obtain unused objects in Network Security

FMC CLI command to obtain unused objects

jdonjuanl — Wed, 08 Apr 2020 22:40:51 GMT

Hello

Is there a CLI command to obtain unused objects on the FMC?

We are using FMC with firmware 6.4.0.4

Right now the FMC has nearly 18,000 objects and we need to eliminate the ones that are not used.

Regards

Re: FMC CLI command to obtain unused objects

Francesco Molino — Thu, 09 Apr 2020 03:50:13 GMT

Hi

There isn't a tools like this.
From the FMC UI, going to objects, and network objects for example, you'll have binoculars icon to find where it is used.
You can also script using APIs by checking if used any rules. Another solution could be to export the show run of your FTD (objects and ACLs) and use it with the migration tool that could tell you which objects aren't used.

Another tool would be CDO but working only for ASA and FTD (without FMC so FDM).

Re: FMC CLI command to obtain unused objects

Marvin Rhoads — Thu, 09 Apr 2020 04:34:47 GMT

Like @Francesco Molino said except that an exported "show running-config" won't show you all of the objects in FMC - only those deployed to a given device.