firewall rule validator
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
09-23-2011 12:29 PM - edited 03-11-2019 02:29 PM
Ok, so I have a mix of ASA's and IOS firewalls. Constanly folks ask me " can you tell me what ports are open from x.x.x.x to x.x.x.x? I have to sift through lines of ACLs and the task becomes more complex where object groups are used. Does anyone know of a tool or script that will parse through the ACLs and tell me what is open for a given source and destination?
Thanks,
Doug
- Labels:
-
NGFW Firewalls

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
09-23-2011 07:40 PM
Good question. Not that I know of.
Is this port open between this src and this dst - can be answered with a packet tracer command on the ASA platform but, what are all the tcp/udp ports that are open between the src and dest - not possible presently. May be there are 3-rd party tools that could do this but I am not aware of any.
-KS

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
09-23-2011 08:39 PM
i guess, you can use asdm to filter rules with Find option, you can query rulebase that contain source and destination IP addresses, which search and display all rules between the source and destination, this will include rules with object groups, if IP address is contained in that group
-Sony
