Manual export

Export a Cisco ASA by hand

One SSH transcript with the show outputs and every running configuration.

On this page

Check the context mode
Single context mode
Multiple context mode
Save the transcript
What the upload is read for
Through the Relay
Upload
Operational CLI commands

Check the context mode

Run show mode to see whether the ASA is in single or multiple context mode, then follow the matching block. show mode itself does not need to be in the upload.

Single context mode

ASA CLI

enable
terminal pager 0
show version
show inventory
show failover
show license all
show running-config

If terminal pager 0 is refused, use terminal pager lines 0.

Multiple context mode

ASA CLI

enable
terminal pager 0
show version
show inventory
show license all
changeto system
show running-config
show failover
changeto context <name>
show running-config

Repeat changeto context <name> and show running-config for every context the system configuration lists. Run show failover in the system space: a context answers only for itself.

Save the transcript

Save the whole session as one .txt file and keep the prompt lines (fw#, fw/ctx#). ConfigProof uses them to tell which command printed what, and which context a configuration belongs to.
A capture with several contexts opens a picker. Each context is its own analysis and keeps the system space and show outputs, so its hardware, serial and failover facts stay with it. The system space alone is not analyzed.

What the upload is read for

Output	Read for
`show running-config`	The configuration, including failover and cluster settings
`show version`	Release, model, serial and licensed features
`show inventory`	Serial
`show failover`	Failover on or off, this unit's and the peer's state, failover group states
`show license all`	Smart Licensing status

Through the Relay

Reading	Command
Routing table (single context mode)	`show route`, `show ipv6 route`

A routing table in a file you upload yourself is not read.

Upload

Open New analysis
Choose File upload and select the file, or choose Paste, paste the output and select Upload and parse.
It is sent at once
One file per upload. ConfigProof reads the vendor and export type from the content, not the file name, then asks the client, project and name. If your role is limited to certain clients, choose the client first.
Answer the picker if asked
A file that holds several VDOMs, contexts, virtual systems or gateways opens a picker. Each one you choose is its own analysis.

Operational CLI commands

NAT, access lists and VPN

show nat detail
show xlate count
show xlate
show access-list
show vpn-sessiondb summary
show crypto ikev2 sa
show crypto ipsec sa

Routes and routing neighbors

show route
show ipv6 route
show bgp summary
show ospf neighbor
show eigrp neighbors

Interfaces and high availability

show interface ip brief
show arp
show failover
show cluster info

Report evidence and rule hit counts

ASA. Available sources across collection methods

access list: Relay, SSH: Counting window unavailable.; Relay: Counting window unavailable.
nat: Relay, SSH: Counting window unavailable.; Relay: Counting window unavailable.

Hit counters without a supported source: crypto acl.

Without a counting window, zero hits cannot prove a rule is unused.

Supported checks: Active routes, Route decisions, HA state, VPN and NAT, Remote access, Lifecycle dates, Configuration history, Reachability, Rule dependencies
Checks not yet supported: CDP / LLDP, Tunnel, BGP and interface state, Recommended release, Change attribution, Pending changes

Open New analysis

It is sent at once

Answer the picker if asked

Related guides