topic firewall rule validator in Network Security

firewall rule validator

dschaef88 — Mon, 11 Mar 2019 21:29:34 GMT

Ok, so I have a mix of ASA's and IOS firewalls. Constanly folks ask me " can you tell me what ports are open from x.x.x.x to x.x.x.x? I have to sift through lines of ACLs and the task becomes more complex where object groups are used. Does anyone know of a tool or script that will parse through the ACLs and tell me what is open for a given source and destination?

Thanks,

Doug

firewall rule validator

Kureli Sankar — Sat, 24 Sep 2011 02:40:33 GMT

Good question. Not that I know of.

Is this port open between this src and this dst - can be answered with a packet tracer command on the ASA platform but, what are all the tcp/udp ports that are open between the src and dest - not possible presently. May be there are 3-rd party tools that could do this but I am not aware of any.

-KS

Re: firewall rule validator

sonybabu2k1 — Sat, 24 Sep 2011 03:39:48 GMT

i guess, you can use asdm to filter rules with Find option, you can query rulebase that contain source and destination IP addresses, which search and display all rules between the source and destination, this will include rules with object groups, if IP address is contained in that group

-Sony