firewall rule validator

[dschaef88]

Ok, so I have a mix of ASA's and IOS firewalls. Constanly folks ask me " can you tell me what ports are open from x.x.x.x to x.x.x.x? I have to sift through lines of ACLs and the task becomes more complex where object groups are used. Does anyone know of a tool or script that will parse through the ACLs and tell me what is open for a given source and destination?

Thanks,

Doug

[Kureli Sankar]

Good question. Not that I know of.

Is this port open between this src and this dst - can be answered with a packet tracer command on the ASA platform but, what are all the tcp/udp ports that are open between the src and dest - not possible presently. May be there are 3-rd party tools that could do this but I am not aware of any.

-KS

[sonybabu2k1]

i guess, you can use asdm to filter rules with Find option, you can query rulebase that contain  source and destination IP addresses, which search and display all rules between the source and destination, this will include rules with object groups, if IP address is contained in that group

-Sony