topic Both of above are long shot, in Network Security

Reverse engineer permit ip any any

ahmad82pkn — Tue, 12 Mar 2019 07:27:50 GMT

Hi, in many cases when we have to establish connectivity with third parties across firewall, things dont work and we end up with permit ip any any in acl.

what is best way to re engineer specific acl if we want to remove permit ip any any?

is there any software to which we can provide logs or wireshark capture and it can regenerate acl for us ?

that would be too good if such tool exists.

Send data to syslog. Wait

Philip D'Ath — Thu, 10 Mar 2016 03:38:50 GMT

Send data to syslog. Wait week. Use grep to extract out all matching lines.

Sending data to syslog is one

Marius Gunnerud — Thu, 10 Mar 2016 05:27:29 GMT

Sending data to syslog is one option, another option (if possible) is to SPAN the switch port connected to the ASA and view the traffic in Wireshark.

Please remember to select a correct answer and rate helpful posts

Both of above are long shot,

ahmad82pkn — Fri, 11 Mar 2016 14:30:09 GMT

Both of above are long shot, as mentioned in my Question, i was hoping for some parser to which i give LOGS or Wireshark Capture as input and it generate ACL for me 🙂 Was looking for some scripts. if someone develops it, it will be coolest tool . haha.