Finding what object groups an ip address belongs to ?

[Shiva Prasad]

How can i find the object-group or object-groups an ip address belongs to/is part of in an ASA running conf ?

eg. sh run | i ip address or sh run object-group | i <ip add> gives me  the below output

network-object <ip add>

network-object <ip add>

network-object <ip add>

is there a command option that lists the ip address alongwith the object-group names that it belongs to ? as of now i have to look through the output of

"sh run object-group net" manually or save the running config to a text file and use the find function.

Regards,

Shiva

[zbrewer-cco]

That's only for objects and doesn't work with object-groups.

[brfrankl]

This is close but what about if I want to find an object/object group that "would" match?

Example:   I have an object-group with 192.168.64.0/24.  I want to search for 192.168.64.10 and it show me all the object-groups what this IP would get a match without .10 being explicitly defined.

[zbrewer-cco]

I have this problem occasionally too. What I usually do is, if I know the IP I'm looking for might be defined within a larger network:

show run | include 192.168.64

and manually parse the results. If this isn't feasible, sometime packet-tracer will give you the answer you're looking for.

[chris.dale]

Hi Ruslan

Thank you, that is the correct format which relates the object and or object-group to the IP address

Regards

[golive999]

Hi Shiva,

There is no direct way of finding what object group does an IP belong to. However if the IP is specified in the configuration, then

you can do a

packet-tracer input inside tcp <source Ip< <port number> <destination ip> <destination port>

This will pull the ACL with the object-group and display.

now execute

sh run object-group id <object-group name> | include IP address

Hope this helps :)

Please rate.

Thanks
ABD

[pavitpalsingh]

you can Log the session and  Issue : show running-config object-group network 

Open in notepad.

FIND  (ctrl + f) the IP