cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1131
Views
0
Helpful
2
Replies

firewall rule validator

dschaef88
Level 1
Level 1

Ok, so I have a mix of ASA's and IOS firewalls. Constanly folks ask me " can you tell me what ports are open from x.x.x.x to x.x.x.x? I have to sift through lines of ACLs and the task becomes more complex where object groups are used. Does anyone know of a tool or script that will parse through the ACLs and tell me what is open for a given source and destination?

Thanks,


Doug

2 Replies 2

Kureli Sankar
Cisco Employee
Cisco Employee

Good question. Not that I know of.

Is this port open between this src and this dst - can be answered with a packet tracer command on the ASA platform but, what are all the tcp/udp ports that are open between the src and dest - not possible presently. May be there are 3-rd party tools that could do this but I am not aware of any.

-KS

sonybabu2k1
Level 1
Level 1

i guess, you can use asdm to filter rules with Find option, you can query rulebase that contain  source and destination IP addresses, which search and display all rules between the source and destination, this will include rules with object groups, if IP address is contained in that group

-Sony

Review Cisco Networking for a $25 gift card