Jay,

I was going to suggest loading the rules into a 
data structure that suggests a solution, but 
after thinking about that, I don't see how to work 
it either. So...load the rules in a dumb data 
structure (an array of arrays) and create subs 
that look for the common bits in each rule (the 
host part in example 1 and the rule in example 
2) and consolidate them there. 

Perhaps prepend each sub array in the data 
structure with an undef value and fill that 
value with the row number of the consolidated
rule:

@rules = (
  [undef, qw(access-list outside_in permit ip 1.1.1.0 255.255.255.128 host
2.2.2.2)],
  [undef, qw(access-list outside_in permit ip 1.1.1.128 255.255.255.128
host 2.2.2.2)],
);

becomes:

@rules = (
  [2, qw(access-list outside_in permit ip 1.1.1.0 255.255.255.128 host
2.2.2.2)],
  [2, qw(access-list outside_in permit ip 1.1.1.128 255.255.255.128 host
2.2.2.2)],
  [undef, qw(access-list outside_in permit ip 1.1.1.0 255.255.255.0 host
2.2.2.2)],
);

The object-group stuff may need to be handled differently.

Doh! Since Josh pointed out that Cisco already has this, 
I'd see what they have. :-)

Troy


>>> Jay Austad <austad at signal15.com> 02/22/05 2:15 PM >>>
Does anyone know of a perl script that I can use to parse a Cisco PIX
config file and have it suggest the creation of object groups and possibly
summarize the ruleset?

I've got a bunch of PIX configs that need to be cleaned up.  Some are
using conduits, some are using acl's.

If nothing exists like this, does anyone have any suggestions for writing
one in perl?  I can't really think of a good way to go about it.  For
example, if I had this in the config:
access-list outside_in permit ip 1.1.1.0 255.255.255.128 host 2.2.2.2
access-list outside_in permit ip 1.1.1.128 255.255.255.128 host 2.2.2.2

It would suggest replacement with:
access-list outside_in permit ip 1.1.1.0 255.255.255.0 host 2.2.2.2

Or if I had:
access-list outside_in permit ip 1.1.1.0 255.255.255.0 host 2.2.2.1
access-list outside_in permit ip 1.1.1.0 255.255.255.0 host 2.2.2.2
access-list outside_in permit ip 1.1.1.0 255.255.255.0 host 2.2.2.3
access-list outside_in permit ip 1.1.1.0 255.255.255.0 host 2.2.2.4

It would suggest making an object-group for the 2.2.2.x addresses and
replacing the rules with:
access-list outside_in permit ip 1.1.1.0 255.255.255.0 object-group
mygroup