3

So I have given a task to add 1000s of DAP policies after main DAP file crashed and backup is not available due to unfortunate reasons.

There is predefined way of doing it through ASDM which is very tedious. I want to match a username and match his MAC address. Configs look like this in ASDM.

enter image description here

I have thing in mind i have username and mac in hand i can automate this if i can get a way which commands i need to enter on cli. Because i can write script which can do this for me in 5 minutes thousands of enteries.

Bottom Line!

What are the commands i need to enter on CLI to achieve the same ASDM screenshot functionality. Thanks

Improve this question
2
  • 3
    Set ASDM (client side) to show the commands before sending them. Then you can see exactly what it's about to do to your system. Save that snippet and now you have a template for the other 999.
    – Ricky
    Commented Jun 19, 2019 at 0:26
  • Is it not feasible to use the advanced tab and create a Lua script to iterate through your user/Mac pairs?
    – user1647053
    Commented Feb 1, 2020 at 22:53

2 Answers 2

Reset to default
3

From ASA 8.x Dynamic Access Policies (DAP) Deployment Guide :

Note: The dap.xml file, which contains the DAP policies selection attributes, is stored in the ASA's flash. Although you can export the dap.xml file off-box, edit it (if you know about xml syntax), and re-import it back, be very careful, because you can cause ASDM to stop processing DAP records if you have misconfigured something. There is no CLI to manipulate this part of the configuration.

Improve this answer
1
  • Not sure if it's changed since 8.x, but with 9.14 and ASDM 7.17 it won't allow me to copy the dap.xml file back to the flash. A warning dialog box reports that it's a "special system file".
    – 8None1
    Commented Feb 26, 2022 at 14:45
1

One way to find that (when you can't find documentation to point you in the right direction) is to add one via ASDM, and then go to the CLI so you can issue a show run to find where your changes show up. If they aren't visible in the output, it may be one of the few things you have to do via ASDM (unfortunately, there are a few of those) because there is no equivalent CLI command. Another example of one such limitation is real-time log monitoring/filtering - there is no "tail" feature in the CLI, so you're forced to do that via ASDM.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.