Cisco ACL Analyzer

About this tool

Paste a Cisco ASA or IOS access-list — a fragment or a whole config — and the analyzer turns it into a readable table. Each permit or deny line becomes a row showing the action, the protocol and the original rule text, alongside counts of total rules, permits versus denies, and rules flagged as risky. Comment lines and any line without a permit or deny are ignored, so you can paste straight from a terminal session. Parsing runs entirely in your browser and nothing is uploaded.

It is aimed at the review problem rather than the writing problem. Access lists accumulate: a temporary rule for a vendor project, a broad permit added during an incident at 2am, the same entry pasted twice by two engineers. Two hundred lines of ASA syntax are hard to audit by eye, and the entries that matter most — an unrestricted permit, a surviving Telnet allowance, a duplicate — are the ones that blend in. This gives you a shortlist to verify. For a full firewall review, see our cyber security service.

How to use it

Paste the rules, click Analyze, then work through the output:

• Check the Risky count first — any non-zero value means at least one unrestricted permit.
• Scan the Flags column for permit any to any, Telnet, FTP and duplicate markers.
• Compare the permit and deny counts against what you expect for that interface direction.
• Trace each flagged rule to a change record or an owner; anything without one is a candidate for removal.
• Confirm with hit counters on the device before deleting a rule that looks unused.

Common questions

Does my configuration leave my browser?

No. Parsing runs entirely in JavaScript on your own machine and nothing is uploaded or logged. It is still good practice to strip hostnames, comments and anything else you would rather not have sitting in a browser tab before pasting.

What does the analyzer flag as risky?

It flags any permit line containing "any any", which is an unrestricted source-to-destination permit, and counts those in the risky total. It also flags permits to TCP 23 (Telnet) and TCP 21 (FTP) as cleartext protocols, and marks duplicates — lines whose action and match criteria repeat an earlier line.

Does it check rule order or shadowing?

Not fully. It lists rules in the order you paste them and detects exact duplicates, but it does not simulate packet matching, so it will not tell you that a broad rule near the top is shadowing a narrower rule further down. Use it as a first pass, then confirm against hit counters on the device with "show access-list".