searching destination via ASDM, how with 8.3+??

[DannyHuston]

When using ASDM with 8.2 and older code it was easy to search all ACLs based on destination IP by using the filter.  With 8.3 and newer code (I'm testing 9.1) this is no longer the case since ACLs now use real IP.  Is there anyway to search for the NAT-ed/public IP in destination?

[Jouni Forss · Accepted solution]

Hi,

Though I rarely use ASDM I would imagine that you simply cannot do any kind of search that would tell you the public IP address as its not referenced in the ACL rules because of the change you mention.

Then again I think you might have one option.

If you previously had Static NAT configuration and could use the public IP address to find the ACL rules for that specific IP then you could consider renaming/naming your Static NAT objects to use the public IP address in them

For example you might currently have

object network STATIC

host 10.10.10.10

nat (inside,outside) static 1.2.3.4

Where the IP 1.2.3.4 is for example the public IP address

Now if you rename the object to something like this

object network STATIC-1.2.3.4

host 10.10.10.10

nat (inside,outside) static 1.2.3.4

Then you could still do searches using the public IP address.

You should be able to rename the "object network " without affecting the NAT configuration.

On the CLI its done with the command "object network rename "

Change for my example NAT object would be done with

object network STATIC rename STATIC-1.2.3.4

Hope this helps

- Jouni

[Jouni Forss]

I guess the ASDM cant use the object name as a parameter of search. Or I am just doing it wrong

On the CLI this easily done though.

show access-list | inc 1.2.3.4

- Jouni

[DannyHuston]

Acutally that makes more sense.  Currently I'm doing obj-name where name is the private internal IP but it makes more sense that the firewall in particular I'm looking at only filters inbound from internet rules so I'm more interested in public IP when looking at rules.  I think I will just rename.