topic Re: ASA rule check in Network Security

ASA rule check

CCOCNSC21 — Fri, 21 Feb 2020 18:43:02 GMT

Hi All,

Before applying any new firewall rule (source, destination, port) is there any way , i mean a show command in ASA to check whether rule is already permitted or denied by ACL ?

Regards,

Muhammed

Re: ASA rule check

Francesco Molino — Thu, 04 Jan 2018 01:45:15 GMT

Hi

There's no tool for that, however you can use packet-tracer embedded in asa to test a traffic and if this traffic is allowed you'll see a success result if not allowed you'll get a fail status. This way you'll be able to see if your acl needs to be created or not.

Re: ASA rule check

Mohammed al Baqari — Thu, 04 Jan 2018 08:26:39 GMT

Another way is to use show access-l x.x.x.x

Put an IP from the source or destination object and you will see what rule
is matching

Re: ASA rule check

CCOCNSC21 — Fri, 05 Jan 2018 00:06:39 GMT

Hi,

"Sh access-list XXXXX" syntax didn't work. Best way I believe doing via the packet tracer syntax.

Re: ASA rule check

GSA — Fri, 15 May 2020 16:24:42 GMT

cisco IOS access-list verification tool
https://aclcheck.ru