Correct Cisco ASA CLI Command to Delete Network Objects

cisco-asacli

I am a newbie at managing my firewall so this is a really basic question. My firewall is a Cisco 5505.

What is the appropriate command (or commands) to run on the command line interface to delete an object and remove it from all groups and rules it is part of?
This is what I have found but it doesn't let you run it until you have removed the object from all groups and rules:

no object network MyComputer

Is there a command that will remove an object from all groups and all rules it is a part of (or a different object delete command that will do this in one step)?

Best Answer

Unfortunately, Cisco has not given us a precise, one-line way to remove a single object or object-group. This is something that may come in time as the ASA code continues to mature and the ASA's themselves get more CPU resources. The original ASA line was pathetically underpowered in the CPU department. Your 5505, for example, was first released in 2006 and has a Pentium 4 Celeron 2000 MHz!

An intelligent, recursive search through the configuration to remove an object or object-group would require CPU resources that just weren't there when the software was being written. Especially not if they had to come at the cost of processing traffic. I work daily on ASAs with thousands of objects and and tens of thousands of ACL lines, and I wish for this feature every day.

For now we're left with a manual search process, similar to what I demonstrate below. This process can certainly be automated in Python, for example, however I give the manual process to illustrate the logic involved.

For this example, I have the following object, object-group, and ACL:

object network TEST-OBJECT
 host 10.10.10.10

object-group network TESTING-OBJECT-GROUP
 network-object object TEST-OBJECT
 network-object host 10.10.10.20

access-list TEST-ACL extended permit ip any object-group TESTING-OBJECT-GROUP 
access-list TEST-ACL extended permit ip any object TEST-OBJECT

If I want to remove TEST-OBJECT and any references to it, as you found out, I can't simply do the following:

asa2-local(config)# no object network TEST-OBJECT
ERROR: unable to delete object (TEST-OBJECT). object is being used.

I now have to search for all instances of the object and remove those lines.

First, I look at the running-configuration for the object name and for the string p n, which matches object-group network. This gives us the names of all network object-groups, and we now have to simply look for instances of TEST-OBJECT, then go up to find what object-group it is a member of:

asa2-local# show run | inc TEST-OBJECT|p n
object network TEST-OBJECT
object-group network TESTING-OBJECT-GROUP
 network-object object TEST-OBJECT
access-list TEST-ACL extended permit ip any object TEST-OBJECT

So we know we need to remove TEST-OBJECT from the TESTING-OBJECT-GROUP object group, and remove a single ACL line:

asa2-local(config)# object-group network TESTING-OBJECT-GROUP
asa2-local(config-network-object-group)# no network-object object TEST-OBJECT
asa2-local(config-network-object-group)# exit
asa2-local(config)# no access-list TEST-ACL extended permit ip any object TEST-OBJECT

Finally we can successfully remove the object itself and validate that it is gone:

asa2-local(config)# no object network TEST-OBJECT
asa2-local(config)# show run object
asa2-local(config)#
Related Topic