Cisco asa export unused access-list with time stamps last used

[mitchell-ruijgrok]

Hi All,

This is my first time I'm sending a message on this community, so if there isn't enough information please let me know.  

Can some one tell me how I can get a nice clean export of unused access-list with a time stamp for checking which access-list I can and can't remove because there not used at all?

I already have a list of rules who has a hitcnt of 0 but I dont now how long they are not used.

Thanks in advance

With kind regards,

Mitchell

[balaji.bandi]

If you some test environment with Linux hands on - I have used to get these output (later moved to Tuffin archestration tool does the work for you)

https://developer.cisco.com/codeexchange/github/repo/DiogoAndre/acl_stats

hope that help you.

[mitchell-ruijgrok]

Thanks Balaji,

I'm going to try this. I will let you know if this was help full for me as a beginner of linux.

[MHM Cisco World]

ok I have workaround 
these ACL with 0 hitcnt, add LOG to it, 
this make you know if it use or not if you monitor for days and you don't see any log message for these ACL that another indication that these ACL are ever use during monitor time.

[mitchell-ruijgrok]

Hi MHM,

I got around 200 acl with a hitcnt 0. Do I need to LOG them al or is the way that Balaji is telling a beter way to start with?

Thanks in advance.

[MHM Cisco World]

@balaji.bandi  is more professional than Me, 
so Sure try his way and then if you face any issue with linux then try my workaround.
and for 200 ACL, not all only the ACL you are 100% sure it never use, but use log to be more sure.

[balaji.bandi]

@MHM Cisco World - nothing more and less in the technology mate, we are all part of the journey as we learning, so our intention is learn and help where we can, taken your appriciated comments.