topic Re: How to delete hundreds of Unused lines - ASA in Network Security

How to delete hundreds of Unused lines - ASA

Bonnie — Mon, 29 May 2023 17:32:20 GMT

I receive a list of unused rules (hundereds of unused rules) that needs to be deleted from the ASA

I can't seem to find any help on this topic, Is this really a mostly manual process? Please is someone able to share a less painful way of executing this task?

This includes having to remove "hosts" from object-groups.

Appreciate any direction here please

Regards,

Bonnie

Re: How to delete hundreds of Unused lines - ASA

Flavio Miranda — Mon, 29 May 2023 18:48:36 GMT

Take a look in https://www.tunnelsup.com/config-cleanup.html

Re: How to delete hundreds of Unused lines - ASA

MHM Cisco World — Mon, 29 May 2023 18:55:39 GMT

Reset factory' if config need to clean up more more than config need to keep.

Note:- take a backup config before do any change.

Re: How to delete hundreds of Unused lines - ASA

Sheraz.Salim — Mon, 29 May 2023 21:11:47 GMT

I assume this must be production network. if this is the case take extra care doing anything manual. must have a change control in place. If you using ASDM you can view the object/object-group if its used or not used (not required anymore as in your case).

to see what is "Not Used" you go (ASDM) into the "Configuration, Firewall" section and make sure you have turned on "View, Addresses". You should then see the "Not Used". This will display a new pop up windows list of not used object network/object-group you can delete them as it will give you the check list to select.

Re: How to delete hundreds of Unused lines - ASA

Marvin Rhoads — Tue, 30 May 2023 02:56:33 GMT

Plus 1 on @Flavio Miranda 's recommendation. I have used this tool for years without any problem. It generates a snippet of config that you can easily paste in cli to remove the unused object, groups etc. After running it and doing the cleanup, run it again with the updated config - often secondary lines will appear based on having removed the first instance. (Sometimes even a third time - basically re-run it until it come up clean in the tool.)

Re: How to delete hundreds of Unused lines - ASA

Bonnie — Tue, 30 May 2023 15:12:22 GMT

Hi Sheraz, thank you for your reply. This however relates more to just deleting the objects/network groups. My task is to delete unused rules on the ASA (hundreds of them). These are sent to me in an Excel sheet format.