topic I raised a call with TAC in Network Security

CSM FlexConfig to deploy ACL

christopher.wallace — Fri, 21 Feb 2020 14:11:11 GMT

Hi guys,

I have a number of ASA firewalls that are managed via CSM (currently version 4.12). We now need to apply a control plane ACL to traffic arriving on our outside interfaces.

I've created an extended ACL in the CSM Extended Access Lists policy object pages and wish to deploy this. How do I get a FlexConfig to deploy an entire ACL?

Thanks.

Hi Christopher,

pick25690 — Wed, 21 Jun 2017 19:21:32 GMT

Hi Christopher,

I haven't deployed an ACL using flexconfigs however I have used them a few times for a workaround on SNMP.

From using them there I believe you can just copy and paste your config into a flexconfig which you create. Think the settings are that you can have it apply the config first then look to see if it'd in the config when deployed or have it add it to the end of the config if it is not seen in there already.

Dan

I raised a call with TAC

christopher.wallace — Wed, 21 Jun 2017 19:46:50 GMT

I raised a call with TAC today and spoke to them.

Using FlexConfig, you can't deploy an ACL policy that is referenced as a variable. You need to manually create any objects and then create the ACL using static commands.

Following testing, it does appear thankfully that objects and ACLs used in this manner are not cleaned up on the following deployments.