cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
864
Views
3
Helpful
3
Replies

Inactive ACLs in PIX/ASA

kotrade
Level 1
Level 1

Hi Everyone,

I have 30 Cisco PIX and ASA firewalls. Each Interface has ACLs applied with hundreds of Access Control entries.

I would like to know which ACE are inactive for let say last thirty days and should be removed. Any help?

Additionally Any automated tool for that which can do this job and report which ACE are lying in configuration and not getting any hits and should be removed.

Thanks.

3 Replies 3

Collin Clark
VIP Alumni
VIP Alumni

The only way I know of (and have done) is to clear the ACL counters, wait 30 days, and remove the ones with no hit counts.

Thanks. Any direction on software/tool to examines thousands of ACE on PIX/ASA Firewall?

We've only looked at one and it was too expensive.

http://www.skyboxsecurity.com/?CategoryID=163

A google search of "Firewall rule audit" comes up with a few more links.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: