Under the NERC CIP program, we must identify all open services on our ASA firewalls. By open services, I mean anything that the firewall might accept and terminate an IP connection for. This would not apply to connections through the firewall. Since the firewall cannot be effectively scanned with a port scanner, we have resorted to searching for the presence of commands that are known to enable services. At this time, I believe our approach is weak, and does not capture all services, or needlessly searches for config text that does not actually enable a service. I am hoping to assemble a list of all services that an ASA can offer and the commands that enable those services. Your suggestions would be great.
