Reverse engineer permit ip any any

[ahmad82pkn]

Hi, in many cases when we have to establish connectivity with third parties across firewall, things dont work and we end up with permit ip any any in acl.

what is best way to re engineer specific acl if we want to remove permit ip any any?

is there any software to which we can provide logs or wireshark capture and it can regenerate acl for us ? 

that would be too good if such tool exists.

[Philip D'Ath]

Send data to syslog.  Wait week.  Use grep to extract out all matching lines.

[ahmad82pkn]

Both of above are long shot, as mentioned in my Question, i was hoping for some parser to which i give LOGS or Wireshark Capture as input and it generate ACL for me :) Was looking for some scripts. if someone develops it, it will be coolest tool . haha.

[Marius Gunnerud]

Sending data to syslog is one option, another option (if possible) is to SPAN the switch port connected to the ASA and view the traffic in Wireshark.

--

Please remember to select a correct answer and rate helpful posts