ACL / NAT management

onesaint

For those here on TE that deal with ACLs and NAT policies in abundance and/or on a large scale, how do you manage your ACLs / NAT rules? Do you use something like excel and write out in plain English what each rule is doing with traffic and what not (this would seem like a huge timesuck)? Or are there specific tools for managing these policies and documenting changes, etc.?

I realize in some capacity a good network engineer should be able to figure out quickly what a rule is doing with traffic, but when dealing with a large amout of rules, I would think documenting them and what they do with traffic would come in handy for quick reference.

TYIA for your input.

MAC_Addy

I normally just manage all my devices through SSH and use the show access-lists/show ip nat translations command.

However, I can see why having NAT/ACL rules copy and pasted in a document would be handy.

jibbajabba

We tried once to document NAT and ACL rules but failed. Failed because someone WILL forget to update the documents so you end up checking anyway. So in Cisco we simply check the ACL via telnet / ssh and NAT we just check the firewall UI (Sonicwall in our case).

onesaint

Thanks Gents.
I was hoping there was a tool to avoid manually updating a document. I know that's a pain and ultimately fails. I suppose I'll end up scripting something to pull from all the routers and **** that to a csv or something.

phatrik

Why not just add remarks between ACLs? Remark This does ASDF A 10 20 30 40 Remark End of ASDF A Remark ASDF B 50 60 70 80 Remark End of ASDF B For NAT rules, you could use ACLs to target traffic, which once again would allow you to add a remark.

onesaint

Definitely a good thing to have. I was looking for something to take the rules / policies offline if possible.

unclerico

We use Cisco Security Manager for our ASAs

Cisco Security Manager - Products & Services - Cisco Systems