topic Re: Finding what object groups an ip address belongs to ? in Network Security

Finding what object groups an ip address belongs to ?

Shiva Prasad — Mon, 11 Mar 2019 17:19:30 GMT

How can i find the object-group or object-groups an ip address belongs to/is part of in an ASA running conf ?

eg. sh run | i ip address or sh run object-group | i <ip add> gives me the below output

network-object <ip add>

is there a command option that lists the ip address alongwith the object-group names that it belongs to ? as of now i have to look through the output of

"sh run object-group net" manually or save the running config to a text file and use the find function.

Regards,

Shiva

Re: Finding what object groups an ip address belongs to ?

Federico Coto Fajardo — Wed, 10 Mar 2010 17:42:40 GMT

Hi,

You can do the command:
sh run | i x.x.x.x

This will show all part of the configuration where the x.x.x.x IP belongs to.
For instance, if x.x.x.x is part of a static command, and ACL, and object-group, etc, it will prompt at the output of that command.

If your using names, you can disable that temporarily with the ''no names'' command.

Let me know if this does not help, because you're mentioning this command already.

Federico.

Re: Finding what object groups an ip address belongs to ?

gginty — Wed, 10 Mar 2010 17:45:59 GMT

Can someone please tell me where the link to Netypro is these days?? It used to be an option, but can no longer find it

Re: Finding what object groups an ip address belongs to ?

Federico Coto Fajardo — Wed, 10 Mar 2010 17:52:52 GMT

Ooopsss...

You did not like the answer, I'm sorry.

The best I can find is to do:

sh run | begin x.x.x.x

That will show all parts of the running-config where the IP address belongs along with the object-group names.

Edit- Sorry, this is not what you're looking for, I apologize for the misleading information. I'll try and see if I find an answer for you.

Federico.

Re: Finding what object groups an ip address belongs to ?

Federico Coto Fajardo — Wed, 10 Mar 2010 18:25:23 GMT

Not the answer you were looking for...

But can't find a command that shows you just the name of the object-group and the IP to which it belongs.

Think you're stucked with the ''sh run'' or two show commands (one for the IP and one for the object-group)

Perhaps somebody else can correct me if I'm wrong.

Federico.

Re: Finding what object groups an ip address belongs to ?

Shiva Prasad — Wed, 10 Mar 2010 22:35:57 GMT

I think we are stuck with limited command options in the asa, but such a feature is available in cisco router IOS as per info from a friend of mine. It is something like that shown below, i am yet to try that on a router if someone is very curious you can try and let us all know.

sh run object-group | section

Regards,

Shiva

Re: Finding what object groups an ip address belongs to ?

Kureli Sankar — Thu, 11 Mar 2010 04:00:36 GMT

Shiva,

You are correct. There is no | s command in the ASA.

But, you can issue the following. sh run said that it is in the network object-group so, I issued a sh object-group network

ASA# sh run | i 3.3.3.3
network-object host 3.3.3.3

ASA# sh run object-group network
object-group network 4080
network-object host 1.1.1.1
network-object host 2.2.2.2
network-object host 3.3.3.3

-KS

Re: Finding what object groups an ip address belongs to ?

Shiva Prasad — Thu, 11 Mar 2010 08:47:26 GMT

Hi KS,

i think you missed parts of my initial query, the commands that you used would be perefctly fine if you had only one network object group defined in the configuration and if the ip was part of only that one group, i was looking for a command that would list all the object groups an object is part of.

I think this would be a handy feature to have in future releases of the ASA SW, is someone from the product development listening ?

Regards,

Shiva

Re: Finding what object groups an ip address belongs to ?

markford2 — Tue, 31 May 2011 16:36:47 GMT

Maybe not for ASAs, but for routers/switches...

sh object-group | inc object|x.x.x.x

Re: Finding what object groups an ip address belongs to ?

UST GLOBAL — Thu, 07 Jul 2011 10:58:10 GMT

Hi,

this is not possible through ASA CLI, but is possible through ASDM.

Configuration->Firewall->AccessRules->Addresses(in the right most conrner), screenshot attached for details

SPK

Re: Finding what object groups an ip address belongs to ?

Erik Ingeberg — Thu, 07 Jul 2011 13:53:38 GMT

There is an even easier way to do this in ASDM. If you look at the screenshot posted by UST_GLOBAL, and right click on the content of one of the groups, you will be able to select "where used". This will show you a list of all the places this address is used.

Re: Finding what object groups an ip address belongs to ?

UST GLOBAL — Thu, 07 Jul 2011 14:36:21 GMT

it was described under the impression that we know only the IP address details and not the object group name. Consider there is a large number of object-groups present if we give the IP address in the filter of the "Addresses" will give all the object-group

SPK

Re: Finding what object groups an ip address belongs to ?

bradley.thornton — Tue, 23 Aug 2011 13:58:13 GMT

Maybe not exactly what you were looking for but this is as close as I was ever able to get w/o ASDM.

no names

sho run object-group network | i object-group|1.2.3.4

you'll get the object-group names and 1.2.3.4 is the IP address.

Brad

Hi Shiva,There is no direct

golive999 — Tue, 05 May 2015 11:16:14 GMT

Hi Shiva,

There is no direct way of finding what object group does an IP belong to. However if the IP is specified in the configuration, then

you can do a

packet-tracer input inside tcp <source Ip< <port number> <destination ip> <destination port>

This will pull the ACL with the object-group and display.

now execute

sh run object-group id <object-group name> | include IP address

Hope this helps 🙂

Please rate.

Thanks
ABD

you can Log the session and

pavitpalsingh — Wed, 24 Jun 2015 07:29:25 GMT

you can Log the session and Issue : show running-config object-group network

Open in notepad.

FIND (ctrl + f) the IP

BEST ANSWER.... thanks, this

andy — Mon, 03 Aug 2015 14:00:56 GMT

BEST ANSWER.... thanks, this helped me out greatly.

encountered recently the same

Ruslan Moldaliev — Thu, 22 Dec 2016 12:52:04 GMT

encountered recently the same task - find object by its IP and I found simple and easy way:

#show running-config object network in-line | i x.x.x.x

and one can see name and IP address in one line

object network HOST-1 host 10.1.y.y
object network HOST-2 host 10.1.y.y
object network HOST-3 host 10.1.y.y

no need to use double grep

Re: encountered recently the same

zbrewer-cco — Wed, 19 Sep 2018 13:41:26 GMT

That's only for objects and doesn't work with object-groups.

Re: encountered recently the same

brfrankl — Mon, 01 Oct 2018 14:11:11 GMT

This is close but what about if I want to find an object/object group that "would" match?

Example: I have an object-group with 192.168.64.0/24. I want to search for 192.168.64.10 and it show me all the object-groups what this IP would get a match without .10 being explicitly defined.

Re: encountered recently the same

zbrewer-cco — Fri, 19 Oct 2018 21:03:07 GMT

I have this problem occasionally too. What I usually do is, if I know the IP I'm looking for might be defined within a larger network:

show run | include 192.168.64

and manually parse the results. If this isn't feasible, sometime packet-tracer will give you the answer you're looking for.