ASA rule check

[CCOCNSC21]

Hi All,

Before applying any new firewall rule (source, destination, port) is there any way , i mean a show command in ASA to check whether rule is already permitted or denied by ACL ?

Regards,

Muhammed

[Francesco Molino · Accepted solution]

Hi

There's no tool for that, however you can use packet-tracer embedded in asa to test a traffic and if this traffic is allowed you'll see a success result if not allowed you'll get a fail status. This way you'll be able to see if your acl needs to be created or not.

[Mohammed al Baqari]

Another way is to use show access-l x.x.x.x

Put an IP from the source or destination object and you will see what rule
is matching

[CCOCNSC21]

Hi,



"Sh access-list XXXXX" syntax didn't work. Best way I believe doing via the packet tracer syntax.

[GSA]

cisco IOS access-list verification tool
https://aclcheck.ru