# Parsing Cisco Configs

> Parse Cisco ASA and FTD running configurations into the shared firewall schema. Use when input contains show running-config, access-list, access-group, object network, object-group, nameif, security-level, NAT, interfaces, or failover, including audit, conversion, diff, summary, and explanation tasks.

- **Type:** Skill
- **Install:** `agentstack add skill-fastrevmd-lab-fwskillsshare-parsing-cisco-configs`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [fastrevmd-lab](https://agentstack.voostack.com/s/fastrevmd-lab)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [fastrevmd-lab](https://github.com/fastrevmd-lab)
- **Source:** https://github.com/fastrevmd-lab/fwskillsshare/tree/main/skills/parsing-cisco-configs
- **Website:** https://mechub.org

## Install

```sh
agentstack add skill-fastrevmd-lab-fwskillsshare-parsing-cisco-configs
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Parsing Cisco ASA / FTD Configurations

## Overview

Use this skill to parse Cisco ASA and ASA-style FTD running configurations into the shared vendor-neutral firewall intermediate schema. It focuses on line-oriented `show running-config` text with parent commands and indented subcommands, including interfaces/nameifs, ACLs/access-groups, network and service objects, object-groups, NAT, routes, VPN, failover, and system settings.

Treat FMC-managed FTD exports and API data as adjacent but not identical inputs: parse what is present, preserve unresolved or unsupported structures in `residual_raw`, and call out assumptions rather than inventing missing policy context.

## Scope and routing

Use only for Cisco ASA or FTD syntax. Hand off FortiOS `config/edit/next/end` blocks to `parsing-fortinet-configs`, PAN-OS XML or `set deviceconfig` to `parsing-palo-configs`, and Junos hierarchy or `set security` to `parsing-srx-configs`. Verify production-bound results against current device documentation and output. Downstream consumers are the audit, conversion, and diff skills.

## Input Format

Cisco ASA configs are line-oriented with indented sub-commands:
```
interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 203.0.113.1 255.255.255.0
!
object network web-server
 host 10.0.1.10
 nat (inside,outside) static 203.0.113.10
!
access-list outside_in extended permit tcp any object web-server eq 443
access-group outside_in in interface outside
```

Key syntax rules:
- Top-level commands start at column 0
- Sub-commands are indented with one space
- `!` separates logical sections
- Named interfaces use `nameif` (e.g., `inside`, `outside`, `dmz`)
- `security-level` (0-100) determines trust level

### Building Command Blocks

Group indented lines under their parent top-level command — see references/parsing-patterns.md "Building Command Blocks" for the algorithm and worked example.

## Extraction Pipeline

### 1. Interfaces
Source: `interface ` blocks
Extract from sub-commands:
- `nameif ` — the logical name used everywhere else
- `security-level ` — trust level
- `ip address  ` — IP and subnet mask
- `vlan ` — VLAN assignment
- `shutdown` — interface is administratively down
- `description `
- `bridge-group ` — transparent mode bridge group membership
- `ip address dhcp` — DHCP client mode (no static IP)
- `ipv6 address  [eui-64]` — IPv6 address
- `mtu ` — MTU setting
- `management-only` — management-only interface flag
- `channel-group ` — LAG/EtherChannel membership (Port-channel parent)
- `tunnel source interface ` — VPN tunnel source
- `tunnel destination ` — VPN tunnel destination
- `tunnel protection ipsec profile ` — IPsec profile binding

Interface types: detect `Port-channel*` as lag, `Tunnel*` as tunnel, `Loopback*` as loopback, `Management*` as management. Sub-interfaces contain `.` in name (e.g., `GigabitEthernet0/0.100`) — derive parent from name before the dot.

### 2. Zones (Derived from Interfaces)
ASA doesn't have explicit zones. Derive them from `nameif` values:
- Each unique `nameif` becomes a zone
- `security-level` values are parser-internal inference metadata used to determine relative trust ordering between zones (higher = more trusted). This is NOT emitted as a `security_level` or `trust_level` field in the intermediate schema — use it only to guide ordering or warn when ACLs are absent.
- Associate the interface with its zone

### 3. Network Objects
Source: `object network ` blocks
Types from sub-commands:
- `host ` → type: "host", value: ip + "/32" (or "/128" for IPv6)
- `subnet  ` → type: "subnet", value: ip + "/cidr" (convert mask to CIDR)
- `range  ` → type: "range", value: "start-end"
- `fqdn v4 ` or `fqdn v6 ` → type: "fqdn"

Note: bare `fqdn ` (without v4/v6 qualifier) is also valid.

- `subnet ` → for IPv6 subnets the value is already in CIDR form, no mask conversion needed.

Also extract: `description`, inline `nat` statement (for object/auto NAT).

### 4. Network Object Groups
Source: `object-group network ` blocks
Members from sub-commands:
- `network-object host ` → inline host
- `network-object  ` → inline subnet
- `network-object object ` → reference to named object
- `group-object ` → nested group reference

### 5. Service Objects
Source: `object service ` blocks
Parse: `service  [source  ] [destination  ]`
Operators: `eq`, `range`, `gt`, `lt`, `neq`

### 6. Service Object Groups
Source: `object-group service  []` blocks
Members:
- `port-object eq ` / `port-object range  `
- `service-object  [destination  ]`
- `service-object object `
- `group-object `

### 7. Protocol Object Groups
Source: `object-group protocol ` blocks
Members: `protocol-object `

### 8. Access Lists (Security Policies)
Source: `access-list  extended     []`

**ACL Remarks:**
`access-list  remark ` — attach as `comment` to the NEXT ACL entry.

**ACL Line Parsing — Token by Token:**

Format: `access-list  extended     [] [log] [time-range ]`

**Protocol field:**
- `ip` — any IP protocol
- `tcp`, `udp`, `icmp`, `sctp` — specific protocols
- `object-group ` — protocol group reference

**Address parsing** (for both source and destination):
- `any` / `any4` / `any6` → "any"
- `host ` → specific host
- `object ` → named network object
- `object-group ` → network object group
- ` ` → network/subnet-mask pair (convert standard subnet mask to CIDR)
- `interface ` → the IP of that interface

**Source port parsing** (after source address, for TCP/UDP — optional):
- `eq ` / `range  ` → source port match (less common)

**Service/port parsing** (after destination address, for TCP/UDP):
- `eq ` → single port (use name or number)
- `range  ` → port range
- `gt ` → greater than
- `lt ` → less than
- `neq ` → not equal (warn: limited cross-platform support)
- `object-group ` → service group reference

**ICMP parsing** (for ICMP protocol):
- Optional ICMP type after destination: `icmp    []`

**Flags:**
- `log [] [interval ]` → enable logging
- `time-range ` → schedule reference
- `inactive` → disabled

### 9. Access Groups (Binding ACLs to Interfaces/Zones)
Source: `access-group   interface `
Also: `access-group  global` (applies to all interfaces)

**Critical: Deriving Zone-Based Policies from ACLs**

ACLs alone don't have zone info. Combine with access-groups:
- `access-group outside_in in interface outside` → policies from this ACL have:
  - `src_zones: ["outside"]` (traffic enters on this interface, so it is the source zone)
  - `dst_zones:` must be inferred (often "any" unless the ACL destination addresses map to a zone)
- For `in` direction: traffic is entering the named interface, so that interface is the **source zone**
- For `out` direction: traffic is leaving the named interface
- For `global`: applies regardless of interface

Build security policies by iterating ACL entries and attaching zone information from access-groups.

### 10. NAT Rules

**Object NAT (Auto NAT):**
Found inside `object network` blocks as `nat (,)  `
- `nat (inside,outside) static 203.0.113.10` → static 1:1 NAT
- `nat (inside,outside) dynamic interface` → dynamic PAT to interface
- `nat (inside,outside) dynamic pat-pool ` → dynamic PAT to pool

**Twice NAT (Manual NAT):**
Top-level: `nat (,) [after-auto] [] source    [destination   ] [service  ]`

Parse `source static|dynamic` and optional `destination static` components.
The optional numeric token is a line number — the rule's position within its manual NAT section — NOT a section selector. Derive the section from rule form: Section 1 = manual/twice NAT without `after-auto` (evaluated before object/auto NAT); Section 2 = object/auto NAT (rules inside `object network` blocks); Section 3 = manual NAT with the `after-auto` keyword (evaluated after all auto NAT).

### 11. Time Ranges (Schedules)
Source: `time-range ` blocks
Sub-commands:
- `absolute start   end  `
- `periodic   to `

### 12. Routing
- **Static routes (IPv4):** `route     []`
- **Static routes (IPv6):** `ipv6 route    []`
- **BGP:** `router bgp ` block — extract:
  - `router-id`, `address-family ipv4 unicast`
  - Per-neighbor: `remote-as`, `description`, `update-source`, `password`, `timers` (keepalive/hold), `next-hop-self`, `soft-reconfiguration`, `route-reflector-client`, `shutdown`
  - `network` statements (convert mask to CIDR)
  - `redistribute` (connected/static)
  - Note: route-map and prefix-list references are not converted (warn)
- **OSPF:** `router ospf ` block — extract:
  - `router-id`, `auto-cost reference-bandwidth`
  - `network   area ` — match interfaces to areas via wildcard mask comparison
  - Area types: stub, nssa, with `no-summary`; area default-cost; area authentication
  - `passive-interface default` + `no passive-interface ` exceptions
  - `redistribute` (connected/static with metric/metric-type)
  - Interface-level: `ip ospf cost`, `ip ospf priority`, `ip ospf hello-interval`, `ip ospf dead-interval`, `ip ospf network point-to-point`, `ip ospf authentication message-digest` + key
  - Normalize area IDs to dotted-decimal (0 → 0.0.0.0)
- **OSPFv3:** `router ospfv3` block with `address-family ipv6 unicast` — similar structure to OSPFv2

### 13. Infrastructure
- **Hostname:** `hostname ` and `domain-name ` → system metadata
- **Version:** `asa version ` or `firepower version ` → metadata.source_version
- **HA/Failover:** `failover` presence + `failover lan unit primary|secondary` (capture unit role),
  `failover interface ip`, `failover link`
- **Screen/Threat Detection:** `threat-detection basic-threat` + `threat-detection rate` entries
- **DNS:** `dns server-group DefaultDNS` block → extract `name-server` entries
- **NTP:** `ntp server  [prefer]`
- **Management Access:** `ssh|http|telnet   ` — track which management protocols are accessible per zone
- **Admin Users:** `username  password ... privilege ` — map privilege 15=super-admin, 1-14=operator, 0=read-only. `username  attributes` block with `ssh authentication publickey ` for SSH keys.
- **VPN/IPsec:**
  - `crypto ikev2 policy ` blocks: encryption, integrity, DH group, lifetime
  - `crypto ikev1 policy ` blocks: authentication, encryption, hash, DH group, lifetime
  - `crypto ipsec ikev2 ipsec-proposal `: protocol esp encryption/integrity
  - `crypto ipsec ikev1 transform-set   `
  - `crypto ipsec profile `: link proposals to PFS groups
  - `tunnel-group  ipsec-attributes`: PSK, certificates, authentication method
  - VTI assembly: match Tunnel interfaces to IPsec profiles, resolve tunnel source/destination, collect routes through tunnel nameifs
  - Canonicalize algorithm names (ASA encryption names are mostly already canonical; e.g., sha → sha1, esp-3des → 3des)
  - Flag weak algorithms (DES/3DES, MD5, DH group ≤ 5)
- **Syslog:** `logging host  `
- **DHCP Server:** `dhcpd address - ` (pool range),
  `dhcpd dns  []`, `dhcpd domain `, `dhcpd lease `,
  `dhcpd enable ` (commit trigger — binds staged options to interface).
  Derive network CIDR from the interface IP.
- **DHCP Relay:** `dhcprelay server  ` + `dhcprelay enable `

### 14. Application Mapping (L7 → Canonical)

ASA/FTD is a port-based platform — it does not have native L7 application awareness in ACLs.
However, when converting FROM ASA to an app-aware platform (PAN-OS, FortiGate), or comparing
configs, the parser should attempt to resolve well-known port/protocol combinations to canonical
application names.

**Resolution from port-based services:**
For each service object or inline port match, check if the protocol+port maps to a known application:

| Protocol | Port(s) | Canonical App | Category |
|----------|---------|---------------|----------|
| TCP | 443 | `https` | web |
| TCP | 80 | `http` | web |
| TCP | 22 | `ssh` | remote-access |
| TCP | 3389 | `rdp` | remote-access |
| UDP | 53 | `dns` | network-mgmt |
| TCP | 25 | `smtp` | email |
| TCP | 465 | `smtps` | email |
| TCP | 993 | `imaps` | email |
| TCP | 143 | `imap` | email |
| UDP | 123 | `ntp` | network-mgmt |
| UDP | 161 | `snmp` | network-mgmt |
| UDP | 162 | `snmp-trap` | network-mgmt |
| TCP | 21 | `ftp` | file-transfer |
| TCP | 23 | `telnet` | remote-access |
| TCP | 389 | `ldap` | auth |
| TCP | 636 | `ldaps` | auth |
| UDP | 69 | `tftp` | file-transfer |
| TCP | 1433 | `mssql` | database |
| TCP | 3306 | `mysql` | database |
| TCP | 5432 | `postgresql` | database |
| TCP | 445 | `smb` | file-transfer |
| UDP | 500 | `ipsec` | tunnel |
| UDP | 4500 | `ipsec-nat-t` | tunnel |
| TCP | 5060 | `sip` | voip |
| UDP | 5060 | `sip` | voip |

**ASA named port keywords:** Map ASA port names to numbers before resolving — full table in references/parsing-patterns.md "Port Name Resolution". Caution: ASA literals predate IANA assignments (`radius`=1645, `radius-acct`=1646, `kerberos`=750) — do not "correct" them from prior knowledge; use the reference table.

**On policy output:** When a service match resolves to a known application, populate the policy's
`apps` array with `{ vendor_name: "tcp/443", canonical: "https", confidence: 1.0, category: "web" }`.
The `services` array still keeps the port-based match. This enables downstream converters to use
the app-aware rule on platforms that support it.

**Unresolvable services:** Complex port ranges, non-standard ports, or protocol groups that don't
map to a single known application → keep as port-based services only, no `apps` entry.

### 15. Application Groups

ASA does not have application groups. However, when converting FROM an app-aware platform,
object-group service entries that resolve entirely to known applications should be flagged
as potential `application_groups` in the IR for downstream use.

### 16. Anonymous Objects
When inline addresses/services appear in ACLs or object groups without a named reference (e.g., `host 10.0.1.10` directly in an ACL line), create anonymous objects with auto-generated names (e.g., `anon-1-host`, `anon-2-net`). This ensures every IR reference points to a named object.

### 17. Residual Config Capture
Capture unrecognized top-level commands verbatim. Categorize into: VPN/IPsec, AAA, QoS, PKI/Certificates, IPv6, Other. Store in `residual_raw` for manual review.

### 18. Transparent Mode
Detect: `firewall transparent` in config
When in transparent mode:
- Interfaces are in bridge-groups instead of having IPs
- `bridge-group ` on interfaces
- BVI interfaces (`interface BVI`) carry the management IP
- Zones derived from nameifs still work the same way

### 19. Implicit Rules
The ASA implicit deny is scoped per bound ACL, not global: each ACL applied via `access-group`
ends with an implicit deny for that interface/direction only. Applying an ACL on one interface
does NOT disable security-level defaults for other interface pairs.

After building all policies from ACLs + access-groups, append:
- **Implicit: Default Deny** — one per access-group binding — action: "deny",
  `src_zones: []` for `in` direction (`dst_zones` for `out`; all any for
  `global`), remaining fields any, `_implicit: true`
- When every traffic-passing interface has a bound ACL (or a `global` access-group exists),
  the per-binding denies may be collapsed into a single final any→any deny, `_implicit: true`
- For interfaces with NO ACL bound: do not fabricate a deny — security-level defaults still
  apply (higher-to-lower permitted, lower-to-higher denied). Add a `metadata.warnings` entry
  ("no ACL bound on  — security-level high-to-low permit applies") and, if downstream
  consumers need explicit rules, model the default permit as an `_implicit: true` allow policy
  from that zone to lower-security zones

Implicit-rule `name` values (e.g. "default-deny", "Implicit: Default Deny") are free-form labels; consumers must match implicit rules on `_implicit: true`, never on the name.

## Output Format

Present results in the **intermediate schema** format documented in `references/intermediate-schema.md`.

Note: schema sections not yet populated by this pipeline (e.g., `security_profile_objects`, `routing_contexts`) are emitted empty (`[]`/`{}`); any unhandle

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [fastrevmd-lab](https://github.com/fastrevmd-lab)
- **Source:** [fastrevmd-lab/fwskillsshare](https://github.com/fastrevmd-lab/fwskillsshare)
- **License:** Apache-2.0
- **Homepage:** https://mechub.org

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-fastrevmd-lab-fwskillsshare-parsing-cisco-configs
- Seller: https://agentstack.voostack.com/s/fastrevmd-lab
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.