Parsing Cisco Configs

Parsing Cisco ASA / FTD Configurations

Overview

Use this skill to parse Cisco ASA and ASA-style FTD running configurations into the shared vendor-neutral firewall intermediate schema. It focuses on line-oriented show running-config text with parent commands and indented subcommands, including interfaces/nameifs, ACLs/access-groups, network and service objects, object-groups, NAT, routes, VPN, failover, and system settings.

Treat FMC-managed FTD exports and API data as adjacent but not identical inputs: parse what is present, preserve unresolved or unsupported structures in residual_raw, and call out assumptions rather than inventing missing policy context.

Scope and routing

Use only for Cisco ASA or FTD syntax. Hand off FortiOS config/edit/next/end blocks to parsing-fortinet-configs, PAN-OS XML or set deviceconfig to parsing-palo-configs, and Junos hierarchy or set security to parsing-srx-configs. Verify production-bound results against current device documentation and output. Downstream consumers are the audit, conversion, and diff skills.

Input Format

Cisco ASA configs are line-oriented with indented sub-commands:

interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 203.0.113.1 255.255.255.0
!
object network web-server
 host 10.0.1.10
 nat (inside,outside) static 203.0.113.10
!
access-list outside_in extended permit tcp any object web-server eq 443
access-group outside_in in interface outside

Key syntax rules:

• Top-level commands start at column 0
• Sub-commands are indented with one space
• ! separates logical sections
• Named interfaces use nameif (e.g., inside, outside, dmz)
• security-level (0-100) determines trust level

Building Command Blocks

Group indented lines under their parent top-level command — see references/parsing-patterns.md "Building Command Blocks" for the algorithm and worked example.

Extraction Pipeline

1. Interfaces

Source: interface blocks Extract from sub-commands:

• nameif — the logical name used everywhere else
• security-level — trust level
• ip address — IP and subnet mask
• vlan — VLAN assignment
• shutdown — interface is administratively down
• description
• bridge-group — transparent mode bridge group membership
• ip address dhcp — DHCP client mode (no static IP)
• ipv6 address [eui-64] — IPv6 address
• mtu — MTU setting
• management-only — management-only interface flag
• channel-group — LAG/EtherChannel membership (Port-channel parent)
• tunnel source interface — VPN tunnel source
• tunnel destination — VPN tunnel destination
• tunnel protection ipsec profile — IPsec profile binding

Interface types: detect Port-channel* as lag, Tunnel* as tunnel, Loopback* as loopback, Management* as management. Sub-interfaces contain . in name (e.g., GigabitEthernet0/0.100) — derive parent from name before the dot.

2. Zones (Derived from Interfaces)

ASA doesn't have explicit zones. Derive them from nameif values:

• Each unique nameif becomes a zone
• security-level values are parser-internal inference metadata used to determine relative trust ordering between zones (higher = more trusted). This is NOT emitted as a security_level or trust_level field in the intermediate schema — use it only to guide ordering or warn when ACLs are absent.
• Associate the interface with its zone

3. Network Objects

Source: object network blocks Types from sub-commands:

• host → type: "host", value: ip + "/32" (or "/128" for IPv6)
• subnet → type: "subnet", value: ip + "/cidr" (convert mask to CIDR)
• range → type: "range", value: "start-end"
• fqdn v4 or fqdn v6 → type: "fqdn"

Note: bare fqdn (without v4/v6 qualifier) is also valid.

• subnet → for IPv6 subnets the value is already in CIDR form, no mask conversion needed.

Also extract: description, inline nat statement (for object/auto NAT).

4. Network Object Groups

Source: object-group network blocks Members from sub-commands:

• network-object host → inline host
• network-object → inline subnet
• network-object object → reference to named object
• group-object → nested group reference

5. Service Objects

Source: object service blocks Parse: service [source ] [destination ] Operators: eq, range, gt, lt, neq

6. Service Object Groups

Source: object-group service [] blocks Members:

• port-object eq / port-object range
• service-object [destination ]
• service-object object
• group-object

7. Protocol Object Groups

Source: object-group protocol blocks Members: protocol-object

8. Access Lists (Security Policies)

Source: access-list extended []

ACL Remarks: access-list remark — attach as comment to the NEXT ACL entry.

ACL Line Parsing — Token by Token:

Format: access-list extended [] [log] [time-range ]

Protocol field:

• ip — any IP protocol
• tcp, udp, icmp, sctp — specific protocols
• object-group — protocol group reference

Address parsing (for both source and destination):

• any / any4 / any6 → "any"
• host → specific host
• object → named network object
• object-group → network object group
• → network/subnet-mask pair (convert standard subnet mask to CIDR)
• interface → the IP of that interface

Source port parsing (after source address, for TCP/UDP — optional):

• eq / range → source port match (less common)

Service/port parsing (after destination address, for TCP/UDP):

• eq → single port (use name or number)
• range → port range
• gt → greater than
• lt → less than
• neq → not equal (warn: limited cross-platform support)
• object-group → service group reference

ICMP parsing (for ICMP protocol):

• Optional ICMP type after destination: icmp []

Flags:

• log [] [interval ] → enable logging
• time-range → schedule reference
• inactive → disabled

9. Access Groups (Binding ACLs to Interfaces/Zones)

Source: access-group interface Also: access-group global (applies to all interfaces)

Critical: Deriving Zone-Based Policies from ACLs

ACLs alone don't have zone info. Combine with access-groups:

• access-group outside_in in interface outside → policies from this ACL have:
• src_zones: ["outside"] (traffic enters on this interface, so it is the source zone)
• dst_zones: must be inferred (often "any" unless the ACL destination addresses map to a zone)
• For in direction: traffic is entering the named interface, so that interface is the source zone
• For out direction: traffic is leaving the named interface
• For global: applies regardless of interface

Build security policies by iterating ACL entries and attaching zone information from access-groups.

10. NAT Rules

Object NAT (Auto NAT): Found inside object network blocks as nat (,)

• nat (inside,outside) static 203.0.113.10 → static 1:1 NAT
• nat (inside,outside) dynamic interface → dynamic PAT to interface
• nat (inside,outside) dynamic pat-pool → dynamic PAT to pool

Twice NAT (Manual NAT): Top-level: nat (,) [after-auto] [] source [destination ] [service ]

Parse source static|dynamic and optional destination static components. The optional numeric token is a line number — the rule's position within its manual NAT section — NOT a section selector. Derive the section from rule form: Section 1 = manual/twice NAT without after-auto (evaluated before object/auto NAT); Section 2 = object/auto NAT (rules inside object network blocks); Section 3 = manual NAT with the after-auto keyword (evaluated after all auto NAT).

11. Time Ranges (Schedules)

Source: time-range blocks Sub-commands:

• absolute start end
• periodic to

12. Routing

• Static routes (IPv4): route []
• Static routes (IPv6): ipv6 route []
• BGP: router bgp block — extract:
• router-id, address-family ipv4 unicast
• Per-neighbor: remote-as, description, update-source, password, timers (keepalive/hold), next-hop-self, soft-reconfiguration, route-reflector-client, shutdown
• network statements (convert mask to CIDR)
• redistribute (connected/static)
• Note: route-map and prefix-list references are not converted (warn)
• OSPF: router ospf block — extract:
• router-id, auto-cost reference-bandwidth
• network area — match interfaces to areas via wildcard mask comparison
• Area types: stub, nssa, with no-summary; area default-cost; area authentication
• passive-interface default + no passive-interface exceptions
• redistribute (connected/static with metric/metric-type)
• Interface-level: ip ospf cost, ip ospf priority, ip ospf hello-interval, ip ospf dead-interval, ip ospf network point-to-point, ip ospf authentication message-digest + key
• Normalize area IDs to dotted-decimal (0 → 0.0.0.0)
• OSPFv3: router ospfv3 block with address-family ipv6 unicast — similar structure to OSPFv2

13. Infrastructure

• Hostname: hostname and domain-name → system metadata
• Version: asa version or firepower version → metadata.source_version
• HA/Failover: failover presence + failover lan unit primary|secondary (capture unit role),

failover interface ip, failover link

• Screen/Threat Detection: threat-detection basic-threat + threat-detection rate entries
• DNS: dns server-group DefaultDNS block → extract name-server entries
• NTP: ntp server [prefer]
• Management Access: ssh|http|telnet — track which management protocols are accessible per zone
• Admin Users: username password ... privilege — map privilege 15=super-admin, 1-14=operator, 0=read-only. username attributes block with ssh authentication publickey for SSH keys.
• VPN/IPsec:
• crypto ikev2 policy blocks: encryption, integrity, DH group, lifetime
• crypto ikev1 policy blocks: authentication, encryption, hash, DH group, lifetime
• crypto ipsec ikev2 ipsec-proposal : protocol esp encryption/integrity
• crypto ipsec ikev1 transform-set
• crypto ipsec profile : link proposals to PFS groups
• tunnel-group ipsec-attributes: PSK, certificates, authentication method
• VTI assembly: match Tunnel interfaces to IPsec profiles, resolve tunnel source/destination, collect routes through tunnel nameifs
• Canonicalize algorithm names (ASA encryption names are mostly already canonical; e.g., sha → sha1, esp-3des → 3des)
• Flag weak algorithms (DES/3DES, MD5, DH group ≤ 5)
• Syslog: logging host
• DHCP Server: dhcpd address - (pool range),

dhcpd dns [], dhcpd domain , dhcpd lease , dhcpd enable (commit trigger — binds staged options to interface). Derive network CIDR from the interface IP.

• DHCP Relay: dhcprelay server + dhcprelay enable

14. Application Mapping (L7 → Canonical)

ASA/FTD is a port-based platform — it does not have native L7 application awareness in ACLs. However, when converting FROM ASA to an app-aware platform (PAN-OS, FortiGate), or comparing configs, the parser should attempt to resolve well-known port/protocol combinations to canonical application names.

Resolution from port-based services: For each service object or inline port match, check if the protocol+port maps to a known application:

| Protocol | Port(s) | Canonical App | Category | |----------|---------|---------------|----------| | TCP | 443 | https | web | | TCP | 80 | http | web | | TCP | 22 | ssh | remote-access | | TCP | 3389 | rdp | remote-access | | UDP | 53 | dns | network-mgmt | | TCP | 25 | smtp | email | | TCP | 465 | smtps | email | | TCP | 993 | imaps | email | | TCP | 143 | imap | email | | UDP | 123 | ntp | network-mgmt | | UDP | 161 | snmp | network-mgmt | | UDP | 162 | snmp-trap | network-mgmt | | TCP | 21 | ftp | file-transfer | | TCP | 23 | telnet | remote-access | | TCP | 389 | ldap | auth | | TCP | 636 | ldaps | auth | | UDP | 69 | tftp | file-transfer | | TCP | 1433 | mssql | database | | TCP | 3306 | mysql | database | | TCP | 5432 | postgresql | database | | TCP | 445 | smb | file-transfer | | UDP | 500 | ipsec | tunnel | | UDP | 4500 | ipsec-nat-t | tunnel | | TCP | 5060 | sip | voip | | UDP | 5060 | sip | voip |

ASA named port keywords: Map ASA port names to numbers before resolving — full table in references/parsing-patterns.md "Port Name Resolution". Caution: ASA literals predate IANA assignments (radius=1645, radius-acct=1646, kerberos=750) — do not "correct" them from prior knowledge; use the reference table.

On policy output: When a service match resolves to a known application, populate the policy's apps array with { vendor_name: "tcp/443", canonical: "https", confidence: 1.0, category: "web" }. The services array still keeps the port-based match. This enables downstream converters to use the app-aware rule on platforms that support it.

Unresolvable services: Complex port ranges, non-standard ports, or protocol groups that don't map to a single known application → keep as port-based services only, no apps entry.

15. Application Groups

ASA does not have application groups. However, when converting FROM an app-aware platform, object-group service entries that resolve entirely to known applications should be flagged as potential application_groups in the IR for downstream use.

16. Anonymous Objects

When inline addresses/services appear in ACLs or object groups without a named reference (e.g., host 10.0.1.10 directly in an ACL line), create anonymous objects with auto-generated names (e.g., anon-1-host, anon-2-net). This ensures every IR reference points to a named object.

17. Residual Config Capture

Capture unrecognized top-level commands verbatim. Categorize into: VPN/IPsec, AAA, QoS, PKI/Certificates, IPv6, Other. Store in residual_raw for manual review.

18. Transparent Mode

Detect: firewall transparent in config When in transparent mode:

• Interfaces are in bridge-groups instead of having IPs
• bridge-group on interfaces
• BVI interfaces (interface BVI) carry the management IP
• Zones derived from nameifs still work the same way

19. Implicit Rules

The ASA implicit deny is scoped per bound ACL, not global: each ACL applied via access-group ends with an implicit deny for that interface/direction only. Applying an ACL on one interface does NOT disable security-level defaults for other interface pairs.

After building all policies from ACLs + access-groups, append:

• Implicit: Default Deny — one per access-group binding — action: "deny",

src_zones: [] for in direction (dst_zones for out; all any for global), remaining fields any, _implicit: true

• When every traffic-passing interface has a bound ACL (or a global access-group exists),

the per-binding denies may be collapsed into a single final any→any deny, _implicit: true

• For interfaces with NO ACL bound: do not fabricate a deny — security-level defaults still

apply (higher-to-lower permitted, lower-to-higher denied). Add a metadata.warnings entry ("no ACL bound on — security-level high-to-low permit applies") and, if downstream consumers need explicit rules, model the default permit as an _implicit: true allow policy from that zone to lower-security zones

Implicit-rule name values (e.g. "default-deny", "Implicit: Default Deny") are free-form labels; consumers must match implicit rules on _implicit: true, never on the name.

Output Format

Present results in the intermediate schema format documented in references/intermediate-schema.md.

Note: schema sections not yet populated by this pipeline (e.g., security_profile_objects, routing_contexts) are emitted empty ([]/{}); any unhandle

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: fastrevmd-lab
• Source: fastrevmd-lab/fwskillsshare
• License: Apache-2.0
• Homepage: https://mechub.org

Install and usage instructions live in the source repository linked above.