DUPLICATE of #17 Attached ASA ruleset blows up head Flint

#21

Uploading the rules gives this log (note to_cidr_s error):

Logout Settings asa.cfg: Parsing

ERROR (Tue May 11 11:40:16 -0500 2010) -- Error analyzing static (inside,outside) 10.192.46.130 access-list Galileo_Print_Mgr 0 0:: undefined method to_cidr_s' for nil:NilClass /Users/tqbf/codebase/flint/lib/flint/cisco_firewall.rb:166:inparse'/Users/tqbf/codebase/flint/lib/flint/cisco_firewall.rb:80:in each'/Users/tqbf/codebase/flint/lib/flint/cisco_firewall.rb:80:inparse'/Users/tqbf/codebase/flint/lib/flint/firewall.rb:69:in parse!'/Users/tqbf/codebase/flint/lib/flint/cisco_firewall.rb:510:inperform'/Users/tqbf/codebase/flint/vendor/gems/resque-1.8.2/lib/resque/job.rb:130:in perform'/Users/tqbf/codebase/flint/vendor/gems/resque-1.8.2/lib/resque/worker.rb:157:inperform'/Users/tqbf/codebase/flint/vendor/gems/resque-1.8.2/lib/resque/worker.rb:124:in work'/Users/tqbf/codebase/flint/vendor/gems/resque-1.8.2/lib/resque/worker.rb:110:inloop'/Users/tqbf/codebase/flint/vendor/gems/resque-1.8.2/lib/resque/worker.rb:110:in work'/Users/tqbf/codebase/flint/vendor/gems/resque-1.8.2/lib/resque/tasks.rb:24/Users/tqbf/codebase/flint/vendor/gems/rake-0.8.7/lib/rake.rb:636:incall'/Users/tqbf/codebase/flint/vendor/gems/rake-0.8.7/lib/rake.rb:636:in execute'/Users/tqbf/codebase/flint/vendor/gems/rake-0.8.7/lib/rake.rb:631:ineach'/Users/tqbf/codebase/flint/vendor/gems/rake-0.8.7/lib/rake.rb:631:in execute'/Users/tqbf/codebase/flint/vendor/gems/rake-0.8.7/lib/rake.rb:597:ininvoke_with_call_chain'/System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/1.8/monitor.rb:242:in synchronize'/Users/tqbf/codebase/flint/vendor/gems/rake-0.8.7/lib/rake.rb:590:ininvoke_with_call_chain'/Users/tqbf/codebase/flint/vendor/gems/rake-0.8.7/lib/rake.rb:583:in invoke'/Users/tqbf/codebase/flint/vendor/gems/rake-0.8.7/lib/rake.rb:2051:ininvoke_task'/Users/tqbf/codebase/flint/vendor/gems/rake-0.8.7/lib/rake.rb:2029:in top_level'/Users/tqbf/codebase/flint/vendor/gems/rake-0.8.7/lib/rake.rb:2029:ineach'/Users/tqbf/codebase/flint/vendor/gems/rake-0.8.7/lib/rake.rb:2029:in top_level'/Users/tqbf/codebase/flint/vendor/gems/rake-0.8.7/lib/rake.rb:2068:instandard_exception_handling'/Users/tqbf/codebase/flint/vendor/gems/rake-0.8.7/lib/rake.rb:2023:in top_level'/Users/tqbf/codebase/flint/vendor/gems/rake-0.8.7/lib/rake.rb:2001:inrun'/Users/tqbf/codebase/flint/vendor/gems/rake-0.8.7/lib/rake.rb:2068:in standard_exception_handling'/Users/tqbf/codebase/flint/vendor/gems/rake-0.8.7/lib/rake.rb:1998:inrun'/Users/tqbf/codebase/flint/vendor/gems/rake-0.8.7/bin/rake:31/Users/tqbf/codebase/flint/vendor/bin/rake:19:in load'/Users/tqbf/codebase/flint/vendor/bin/rake:19 ERROR (Tue May 11 11:40:16 -0500 2010) -- We do not support static maps with ACLs NOTICE (Tue May 11 11:40:16 -0500 2010) -- Created new interface object, dmz NOTICE (Tue May 11 11:40:16 -0500 2010) -- Created new interface object, outside NOTICE (Tue May 11 11:40:16 -0500 2010) -- Created new interface object, inside NOTICE (Tue May 11 11:40:16 -0500 2010) -- Building model of firewall from configuration. NOTICE (Tue May 11 11:40:15 -0500 2010) -- Building name -> ip mapping from 'name' commands. WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(274): no asdm history enable -- Parse error at "asdm" on line: no asdm history enable" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(273): asdm image disk0:/asdm-603.bin -- Parse error at "asdm" on line: asdm image disk0:/asdm-603.bin" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(272): : end -- Parse error at ":" on line: : end" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(271): Cryptochecksum:735ff74328496cfb66fe57dd05960a99 -- Parse error at "Cryptochecksum:735ff74328496cfb66fe57dd05960a99" on line: Cryptochecksum:735ff74328496cfb66fe57dd05960a99" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(270): prompt hostname context -- Parse error at "prompt" on line: prompt hostname context " WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(269): service-policy global_policy global -- Parse error at "service-policy" on line: service-policy global_policy global" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(267): rtp-conformance enforce-payloadtype -- Parse error at "rtp-conformance" on line: rtp-conformance enforce-payloadtype" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(266): uri-non-sip action mask log -- Parse error at "uri-non-sip" on line: uri-non-sip action mask log" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(265): no traffic-non-sip -- Parse error at "traffic-non-sip" on line: no traffic-non-sip" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(264): strict-header-validation action drop log -- Parse error at "strict-header-validation" on line: strict-header-validation action drop log" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(263): software-version action mask log -- Parse error at "software-version" on line: software-version action mask log" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(262): state-checking action drop-connection log -- Parse error at "state-checking" on line: state-checking action drop-connection log" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(261): max-forwards-validation action drop log -- Parse error at "max-forwards-validation" on line: max-forwards-validation action drop log" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(260): parameters -- Parse error at "parameters" on line: parameters" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(259): description SIP Inspection Map -- Parse error at "SIP" on line: description SIP Inspection Map" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(242): message-length maximum 512 -- Parse error at "message-length" on line: message-length maximum 512" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(241): parameters -- Parse error at "parameters" on line: parameters" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(234): isakmp keepalive threshold 180 retry 10 -- Parse error at "isakmp" on line: isakmp keepalive threshold 180 retry 10" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(233): pre-shared-key * <-- pre-shared key supplied separately to each customer. -- Parse error at "pre-shared-key" on line: pre-shared-key * <-- pre-shared key supplied separately to each customer." WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(232): tunnel-group 198.151.32.18 ipsec-attributes -- Parse error at "tunnel-group" on line: tunnel-group 198.151.32.18 ipsec-attributes" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(231): tunnel-group 198.151.32.18 type ipsec-l2l -- Parse error at "tunnel-group" on line: tunnel-group 198.151.32.18 type ipsec-l2l" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(229): isakmp keepalive threshold 180 retry 10 -- Parse error at "isakmp" on line: isakmp keepalive threshold 180 retry 10" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(228): tunnel-group DefaultWEBVPNGroup ipsec-attributes -- Parse error at "tunnel-group" on line: tunnel-group DefaultWEBVPNGroup ipsec-attributes" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(227): isakmp keepalive threshold 180 retry 10 -- Parse error at "isakmp" on line: isakmp keepalive threshold 180 retry 10" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(226): tunnel-group DefaultRAGroup ipsec-attributes -- Parse error at "tunnel-group" on line: tunnel-group DefaultRAGroup ipsec-attributes" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(225): isakmp keepalive threshold 180 retry 10 -- Parse error at "isakmp" on line: isakmp keepalive threshold 180 retry 10" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(224): tunnel-group DefaultL2LGroup ipsec-attributes -- Parse error at "tunnel-group" on line: tunnel-group DefaultL2LGroup ipsec-attributes" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(223): ntp server 204.152.184.72 source outside -- Parse error at "ntp" on line: ntp server 204.152.184.72 source outside" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(222): ntp server 207.200.81.113 source outside prefer -- Parse error at "ntp" on line: ntp server 207.200.81.113 source outside prefer" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(221): ntp authenticate -- Parse error at "ntp" on line: ntp authenticate" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(220): threat-detection statistics -- Parse error at "threat-detection" on line: threat-detection statistics" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(219): threat-detection scanning-threat shun -- Parse error at "threat-detection" on line: threat-detection scanning-threat shun" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(218): threat-detection basic-threat -- Parse error at "threat-detection" on line: threat-detection basic-threat" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(215): dhcpd enable inside -- Parse error at "dhcpd" on line: dhcpd enable inside" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(214): dhcpd address 192.168.1.100-192.168.1.109 inside -- Parse error at "dhcpd" on line: dhcpd address 192.168.1.100-192.168.1.109 inside" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(212): dhcpd update dns -- Parse error at "dhcpd" on line: dhcpd update dns " WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(211): dhcpd auto_config outside -- Parse error at "dhcpd" on line: dhcpd auto_config outside" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(210): dhcpd lease 86400 -- Parse error at "dhcpd" on line: dhcpd lease 86400" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(209): dhcp-client update dns server both -- Parse error at "dhcp-client" on line: dhcp-client update dns server both" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(208): dhcp-client client-id interface outside -- Parse error at "dhcp-client" on line: dhcp-client client-id interface outside" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(207): console timeout 0 -- Parse error at "console" on line: console timeout 0" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(202): no crypto isakmp nat-traversal -- Parse error at "crypto" on line: no crypto isakmp nat-traversal" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(200): lifetime 86400 -- Parse error at "lifetime" on line: lifetime 86400" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(199): group 2 -- Parse error at "group" on line: group 2" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(198): hash sha -- Parse error at "hash" on line: hash sha" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(197): encryption 3des -- Parse error at "encryption" on line: encryption 3des" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(196): authentication pre-share -- Parse error at "authentication" on line: authentication pre-share" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(195): crypto isakmp policy 30 -- Parse error at "crypto" on line: crypto isakmp policy 30" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(193): crypto isakmp enable outside -- Parse error at "crypto" on line: crypto isakmp enable outside" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(192): crypto map outside_map interface outside -- Parse error at "crypto" on line: crypto map outside_map interface outside" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(191): crypto map outside_map 30 set security-association lifetime seconds 86400 -- Parse error at "crypto" on line: crypto map outside_map 30 set security-association lifetime seconds 86400" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(190): crypto map outside_map 30 set transform-set Galileo-VPN -- Parse error at "crypto" on line: crypto map outside_map 30 set transform-set Galileo-VPN" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(189): crypto map outside_map 30 set peer 198.151.32.18 -- Parse error at "crypto" on line: crypto map outside_map 30 set peer 198.151.32.18 " WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(188): crypto map outside_map 30 set connection-type originate-only -- Parse error at "crypto" on line: crypto map outside_map 30 set connection-type originate-only" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(187): crypto map outside_map 30 match address VPNtoGalileo -- Parse error at "crypto" on line: crypto map outside_map 30 match address VPNtoGalileo" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(186): crypto ipsec transform-set Galileo-VPN esp-3des esp-sha-hmac -- Parse error at "crypto" on line: crypto ipsec transform-set Galileo-VPN esp-3des esp-sha-hmac " WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(184): /-- which is used to translate data put in the VPN to Galileo. -- Parse error at "/--" on line: /-- which is used to translate data put in the VPN to Galileo." WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(183): /-- data encapsulation as well as refers to the access list "VPNtoGalileo" -- Parse error at "/--" on line: /-- data encapsulation as well as refers to the access list "VPNtoGalileo"" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(182): /-- The "crypto" section determines the encryption and -- Parse error at "/--" on line: /-- The "crypto" section determines the encryption and" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(181): /-- isakmp policy numbers. -- Parse error at "/--" on line: /-- isakmp policy numbers." WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(180): /-- you may well need to use different names for your crypto map section and different -- Parse error at "/--" on line: /-- you may well need to use different names for your crypto map section and different" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(179): /-- Be careful with the next section. If you already have VPNs established, -- Parse error at "/--" on line: /-- Be careful with the next section. If you already have VPNs established," WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(176): no snmp-server contact -- Parse error at "$" on line: no snmp-server contact" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(175): no snmp-server location -- Parse error at "$" on line: no snmp-server location" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(170): aaa authorization exec authentication-server -- Parse error at "aaa" on line: aaa authorization exec authentication-server" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(169): aaa local authentication attempts max-fail 3 -- Parse error at "aaa" on line: aaa local authentication attempts max-fail 3" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(168): aaa authorization command LOCAL -- Parse error at "aaa" on line: aaa authorization command LOCAL " WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(167): aaa authentication telnet console LOCAL -- Parse error at "aaa" on line: aaa authentication telnet console LOCAL " WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(166): aaa authentication ssh console LOCAL -- Parse error at "aaa" on line: aaa authentication ssh console LOCAL " WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(165): aaa authentication http console LOCAL -- Parse error at "aaa" on line: aaa authentication http console LOCAL " WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(164): aaa authentication enable console LOCAL -- Parse error at "aaa" on line: aaa authentication enable console LOCAL " WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(163): dynamic-access-policy-record DfltAccessPolicy -- Parse error at "dynamic-access-policy-record" on line: dynamic-access-policy-record DfltAccessPolicy" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(162): timeout uauth 0:05:00 absolute -- Parse error at "timeout" on line: timeout uauth 0:05:00 absolute" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(161): timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 -- Parse error at "timeout" on line: timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(160): timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 -- Parse error at "timeout" on line: timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(159): timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 -- Parse error at "timeout" on line: timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(158): timeout xlate 3:00:00 -- Parse error at "timeout" on line: timeout xlate 3:00:00" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(153): /-- must be outside of the "global (outside) 2" range above -- Parse error at "/--" on line: /-- must be outside of the "global (outside) 2" range above" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(152): /-- assigned to the mainframe sessions. This address (10.192.46.129 in this example) -- Parse error at "/--" on line: /-- assigned to the mainframe sessions. This address (10.192.46.129 in this example)" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(151): /-- that LAN PC to the first usable IP address in the subnet Galileo has -- Parse error at "/--" on line: /-- that LAN PC to the first usable IP address in the subnet Galileo has" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(150): /-- the LAN for the PC running the print server software. The next line ties -- Parse error at "/--" on line: /-- the LAN for the PC running the print server software. The next line ties" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(149): /-- The Galileo_GPM_Print_Mgr access list above selected an IP address from -- Parse error at "/--" on line: /-- The Galileo_GPM_Print_Mgr access list above selected an IP address from" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(148): /-- Remember the requirement for a static one-to-one NAT for the Print server. -- Parse error at "/--" on line: /-- Remember the requirement for a static one-to-one NAT for the Print server." WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(144): /-- to something 10.192.46.131 -- Parse error at "/--" on line: /-- to something 10.192.46.131" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(143): /-- Between the two statements, IP addresses in the 192.168.1.0 subnet are translated -- Parse error at "/--" on line: /-- Between the two statements, IP addresses in the 192.168.1.0 subnet are translated" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(142): /-- The "nat (inside) 2" statement is tied to the "global (outside) 2" statement. -- Parse error at "/--" on line: /-- The "nat (inside) 2" statement is tied to the "global (outside) 2" statement." WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(138): /-- increment these numbers to a higher, unused number. -- Parse error at "/--" on line: /-- increment these numbers to a higher, unused number." WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(137): /-- note, if you already have a "global (outside) 2" and "nat (inside) 2)", simply -- Parse error at "/--" on line: /-- note, if you already have a "global (outside) 2" and "nat (inside) 2)", simply" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(136): /-- the subnet Galileo has assigned to the mainframe sessions and the LAN subnet. -- Parse error at "/--" on line: /-- the subnet Galileo has assigned to the mainframe sessions and the LAN subnet." WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(135): /-- The "global (outside) 2" statement here is the Galileo side of the PAT pool between -- Parse error at "/--" on line: /-- The "global (outside) 2" statement here is the Galileo side of the PAT pool between" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(133): arp timeout 14400 -- Parse error at "arp" on line: arp timeout 14400" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(132): no asdm history enable -- Parse error at "asdm" on line: no asdm history enable" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(131): asdm image disk0:/asdm-603.bin -- Parse error at "asdm" on line: asdm image disk0:/asdm-603.bin" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(129): ip audit attack action drop -- Parse error at "audit" on line: ip audit attack action drop" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(128): ip audit interface outside idsattack -- Parse error at "audit" on line: ip audit interface outside idsattack" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(127): ip audit interface outside idsinfo -- Parse error at "audit" on line: ip audit interface outside idsinfo" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(126): ip audit name idsattack attack action alarm drop reset -- Parse error at "audit" on line: ip audit name idsattack attack action alarm drop reset" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(125): ip audit name idsinfo info action alarm -- Parse error at "audit" on line: ip audit name idsinfo info action alarm" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(124): ip verify reverse-path interface outside -- Parse error at "verify" on line: ip verify reverse-path interface outside" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(123): mtu dmz 1500 -- Parse error at "mtu" on line: mtu dmz 1500" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(122): mtu outside 1500 -- Parse error at "mtu" on line: mtu outside 1500" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(121): mtu inside 1500 -- Parse error at "mtu" on line: mtu inside 1500" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(113): pager lines 25 -- Parse error at "pager" on line: pager lines 25" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(110): /-- each PC running GPM. -- Parse error at "/--" on line: /-- each PC running GPM." WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(109): /-- If you need to run multiple instances of GPM, you will separate access-lists for -- Parse error at "/--" on line: /-- If you need to run multiple instances of GPM, you will separate access-lists for" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(108): /-- ANY LAN IP address can be used for the print server. -- Parse error at "/--" on line: /-- ANY LAN IP address can be used for the print server." WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(107): /-- of the VPN. In this example, GPM is running on a PC with an IP address of 192.168.1.20 -- Parse error at "/--" on line: /-- of the VPN. In this example, GPM is running on a PC with an IP address of 192.168.1.20" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(106): /-- the print server and the address assigned to the print sessions on the Galileo end -- Parse error at "/--" on line: /-- the print server and the address assigned to the print sessions on the Galileo end" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(105): /-- there must be a static, one-to-one NAT relationship between the real IP address of -- Parse error at "/--" on line: /-- there must be a static, one-to-one NAT relationship between the real IP address of" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(104): /-- is used. In order for Galileo's mainframes to be able to deliver these print jobs, -- Parse error at "/--" on line: /-- is used. In order for Galileo's mainframes to be able to deliver these print jobs," WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(103): /-- "print server". In most cases, a software print server called Galileo Print Manager (GPM) -- Parse error at "/--" on line: /-- "print server". In most cases, a software print server called Galileo Print Manager (GPM)" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(102): /-- which requests or generates the print job. Instead, the print job is sent to a -- Parse error at "/--" on line: /-- which requests or generates the print job. Instead, the print job is sent to a" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(101): /-- Print jobs generated by Galileo's hosts is not returned to the end user or application -- Parse error at "/--" on line: /-- Print jobs generated by Galileo's hosts is not returned to the end user or application" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(98): /-- being placed in the VPN to Galileo. -- Parse error at "/--" on line: /-- being placed in the VPN to Galileo." WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(97): /-- NAT is only performed if the packet has a destination on the Galileo network and is -- Parse error at "/--" on line: /-- NAT is only performed if the packet has a destination on the Galileo network and is" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(96): /-- IP address to an address Galileo has assigned. The NAT is "Policy based" in the at the -- Parse error at "/--" on line: /-- IP address to an address Galileo has assigned. The NAT is "Policy based" in the at the" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(95): /-- The VPNtoGalileo access list is used by the crypto section to "globally NAT" the rea -- Parse error at "/--" on line: /-- The VPNtoGalileo access list is used by the crypto section to "globally NAT" the rea" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(94): /-- actually using an IP address in the subnet associated with their mainframe sessions. -- Parse error at "/--" on line: /-- actually using an IP address in the subnet associated with their mainframe sessions." WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(93): /-- it most appear to Galileo's network and firewalls as if the client application is -- Parse error at "/--" on line: /-- it most appear to Galileo's network and firewalls as if the client application is" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(92): /-- in turn are associated with a unique subnet. In order to access these mainframe sessions -- Parse error at "/--" on line: /-- in turn are associated with a unique subnet. In order to access these mainframe sessions" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(91): /-- Each Galileo customer is assigned a set of mainframe host sessions and these sessions -- Parse error at "/--" on line: /-- Each Galileo customer is assigned a set of mainframe host sessions and these sessions" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(88): /-- The LANtoGalileo ACL is used in a "global" statement later in this configuration. -- Parse error at "/--" on line: /-- The LANtoGalileo ACL is used in a "global" statement later in this configuration." WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(84): /-- the GPM software. -- Parse error at "/--" on line: /-- the GPM software." WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(83): /-- Subsitute the 192.168.1.20 IP address shown here for the IP address of the PC running -- Parse error at "/--" on line: /-- Subsitute the 192.168.1.20 IP address shown here for the IP address of the PC running" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(82): /-- itineraries and accounting data ready to be delivered via the GPM software. -- Parse error at "/--" on line: /-- itineraries and accounting data ready to be delivered via the GPM software." WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(81): /-- to notify the GPM software that there are print jobs such as airline ticket, invoices -- Parse error at "/--" on line: /-- to notify the GPM software that there are print jobs such as airline ticket, invoices" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(80): /-- These two lines, alone with the access-group called outside-inbound allow Galileo -- Parse error at "/--" on line: /-- These two lines, alone with the access-group called outside-inbound allow Galileo" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(79): /-- to the Galileo Print Manager print server software running on one PC on your network -- Parse error at "/--" on line: /-- to the Galileo Print Manager print server software running on one PC on your network" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(78): /-- as in this example, you need to explicitily allow for the connection from Galileo -- Parse error at "/--" on line: /-- as in this example, you need to explicitily allow for the connection from Galileo" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(77): /-- Note, if you explicity screen outside to inside traffic on your outside interface -- Parse error at "/--" on line: /-- Note, if you explicity screen outside to inside traffic on your outside interface" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(66): description Production Galileo Hosts -- Parse error at "Production" on line: description Production Galileo Hosts" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(64): /-- Access to this host (57.8.16.41) is optional and only required if using the GIDS product. -- Parse error at "/--" on line: /-- Access to this host (57.8.16.41) is optional and only required if using the GIDS product." WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(63): /-- Galileo Integrated Data Source (GIDS) data uses this host on the Galileo network. -- Parse error at "/--" on line: /-- Galileo Integrated Data Source (GIDS) data uses this host on the Galileo network." WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(62): /-- is a need to access these "copy" systems. These two lines are optional. -- Parse error at "/--" on line: /-- is a need to access these "copy" systems. These two lines are optional." WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(61): /-- Access to these two networks, 57.8.72.0 and 198.177.189.0 is only required if there -- Parse error at "/--" on line: /-- Access to these two networks, 57.8.72.0 and 198.177.189.0 is only required if there" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(60): /-- using our APIs or doing other work in a non-production environment. -- Parse error at "/--" on line: /-- using our APIs or doing other work in a non-production environment." WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(59): /-- Galileo has "Copy System" Hosts; systems which are typlically accessed by developers -- Parse error at "/--" on line: /-- Galileo has "Copy System" Hosts; systems which are typlically accessed by developers" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(58): /-- access are in two networks, 57.8.81.0 and 198.177.164.0 -- Parse error at "/--" on line: /-- access are in two networks, 57.8.81.0 and 198.177.164.0" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(57): /-- Galileo's Production Hosts (Apollo and Galileo), the systems which end users will -- Parse error at "/--" on line: /-- Galileo's Production Hosts (Apollo and Galileo), the systems which end users will" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(55): clock summer-time PDT recurring -- Parse error at "clock" on line: clock summer-time PDT recurring" WARNING (Tue May 11 11:40:15 -0500 2010) -- Failed to parse line(54): clock timezone PST -8 -- Parse error at "clock" on line: clock timezone PST -8" WARNING (Tue May 11 11:40:14 -0500 2010) -- Failed to parse line(52): boot system disk0:/asa803-k8.bin -- Parse error at "boot" on line: boot system disk0:/asa803-k8.bin" WARNING (Tue May 11 11:40:14 -0500 2010) -- Failed to parse line(51): banner login . -- Parse error at "banner" on line: banner login ." WARNING (Tue May 11 11:40:14 -0500 2010) -- Failed to parse line(50): banner login It is for authorized use only. -- Parse error at "banner" on line: banner login It is for authorized use only." WARNING (Tue May 11 11:40:14 -0500 2010) -- Failed to parse line(49): banner login This router is part of a private computer system. -- Parse error at "banner" on line: banner login This router is part of a private computer system." WARNING (Tue May 11 11:40:14 -0500 2010) -- Failed to parse line(48): banner login NOTICE TO USERS -- Parse error at "banner" on line: banner login NOTICE TO USERS" WARNING (Tue May 11 11:40:14 -0500 2010) -- Failed to parse line(47): passwd w.Qfo0JwDCSkHlEo encrypted -- Parse error at "passwd" on line: passwd w.Qfo0JwDCSkHlEo encrypted" WARNING (Tue May 11 11:40:14 -0500 2010) -- Failed to parse line(45): description Power Over Ethernet Port -- Parse error at "Power" on line: description Power Over Ethernet Port" WARNING (Tue May 11 11:40:14 -0500 2010) -- Failed to parse line(42): description Power Over Ethernet Port -- Parse error at "Power" on line: description Power Over Ethernet Port" WARNING (Tue May 11 11:40:14 -0500 2010) -- Failed to parse line(33): switchport access vlan 3 -- Parse error at "switchport" on line: switchport access vlan 3" WARNING (Tue May 11 11:40:14 -0500 2010) -- Failed to parse line(30): description Uplink to Gigabit Switch -- Parse error at "Uplink" on line: description Uplink to Gigabit Switch" WARNING (Tue May 11 11:40:14 -0500 2010) -- Failed to parse line(27): switchport access vlan 2 -- Parse error at "switchport" on line: switchport access vlan 2" WARNING (Tue May 11 11:40:14 -0500 2010) -- Failed to parse line(22): no forward interface Vlan1 -- Parse error at "forward" on line: no forward interface Vlan1" WARNING (Tue May 11 11:40:14 -0500 2010) -- Failed to parse line(21): description -- Parse error at "$" on line: description" WARNING (Tue May 11 11:40:14 -0500 2010) -- Failed to parse line(18): ip address dhcp setroute -- Parse error at "setroute" on line: ip address dhcp setroute " WARNING (Tue May 11 11:40:14 -0500 2010) -- Failed to parse line(7): names -- Parse error at "names" on line: names" WARNING (Tue May 11 11:40:14 -0500 2010) -- Failed to parse line(6): enable password w.Qfo0JwDCSkHlEo encrypted -- Parse error at "enable" on line: enable password w.Qfo0JwDCSkHlEo encrypted" WARNING (Tue May 11 11:40:14 -0500 2010) -- Failed to parse line(5): hostname ciscoasa -- Parse error at "hostname" on line: hostname ciscoasa" WARNING (Tue May 11 11:40:14 -0500 2010) -- Failed to parse line(3): ASA Version 8.0(3) -- Parse error at "ASA" on line: ASA Version 8.0(3) " WARNING (Tue May 11 11:40:14 -0500 2010) -- Failed to parse line(2): : -- Parse error at ":" on line: :" WARNING (Tue May 11 11:40:14 -0500 2010) -- Failed to parse line(1): : Saved -- Parse error at ":" on line: : Saved" NOTICE (Tue May 11 11:40:14 -0500 2010) -- Starting firewall configuration parsing, read 274 lines. Flint Version: 1.0.7 Copyright © 2010 Matasano Security LLC Report a bug | Flint Homepage | Help

asa.cfg 10.2 KB

Reported by tqbf · May 11th, 2010 @ 04:41 PM

Activity

Craig Bugzefsky
- Title changed from Attached ASA ruleset blows up head Flint to DUPLICATE of #17 Attached ASA ruleset blows up head Flint
This is a duplicate of bug 17

May 13th, 2010 @ 08:26 PM

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.