topic Re: ASA ACL Export in Network Security

ASA ACL Export

fatalXerror — Fri, 21 Feb 2020 15:56:01 GMT

Hi Guys,

Need some help to export ACL from my ASA.

I have a lot of ACLs which uses groups also, I tried to use ASDM to export in CSV but the group name is showing instead of the IP address.

You know any ways how to do it?

Thanks

Re: ASA ACL Export

Seb Rupik — Fri, 29 Jun 2018 09:14:23 GMT

Hi there,

The command sh access-list will expand any host/ service groups you have defined in the ACLs and display the IP addresses / port numbers.

You should be able to copy this output from the terminal and parse it as a CSV.

cheers,

Seb.

Re: ASA ACL Export

fatalXerror — Fri, 29 Jun 2018 09:21:17 GMT

Hi Seb,

Thanks for the feedback.

If I parse it from text to csv format, does it by column or just in 1 column because I need to be formatted by column? (e.g. source = 1 column, destination = 1 column)

Thanks

Re: ASA ACL Export

Seb Rupik — Fri, 29 Jun 2018 09:52:10 GMT

The position of subnet ID and mask could be potentially be different for each expanded ACE depending on the composition of the rule (ie including source ports?).

I suggest you take the output and delimit by whitespace. You may need to shift some rows left&right to get the whole table aligned correctly.

cheers,

Seb.