How to find the uplink and downlink devices which is connected to the ASA 5525-x. Is there any command for that?

2 Answers 2


ASA is a firewall, and thus in normal conditions (routed mode) works by looking at the arp table, or neighborhood table for IPv6.

Type show arp to show current active arp entries on the router, or show ipv6 neighbor for IPv6.


asa/custs/act# show arp
    outside 0223.e906.c8cf 15
    inside 0050.569f.1111 135
    inside 0050.569f.2222 196
    inside 0050.569f.3333 222

If it is in transparent mode, you would have to look for mac-address entries in the forwarding database (show mac-address address-table) to see mac-address connected port. More details here, and how to mitigate some regular attacks on the arp/mac-address tables. https://www.cisco.com/c/en/us/td/docs/security/asa/asa94/config-guides/cli/general/asa-94-general-config/basic-arp-mac.html

  • 1
    "ASA is a router" No, Cisco is very clear about this in its documentation and descriptions, plainly stating that ASA is not a router, it is a firewall. It just so happens that it has some routing features, but it is not as powerful in routing as Cisco's other offerings. You can also configure it to be a transparent firewall (no routing).
    – Ron Maupin
    Nov 8, 2022 at 13:25
  • thanks for clarification, I updated my answer.
    – OlofL
    Nov 10, 2022 at 8:55

I think the first thing to clarify here is 'what are uplink/downlink devices'?

I'm guessing that Richard is looking for something akin to CDP Neighbor Discovery (ASA firewalls do not support CDP) or LLDP, etc. At best, the ARP table will show some MAC address information for devices that are connected to the same Layer 2 segments of the interfaces on the ASA Firewall. From the MAC addresses you can discover some brand information about the devices and infer what they might be.

Additionally you might be able to discover information about any devices that have connected via Anyconnect for VPN service or similar.

If you do packet captures, you can probably capture some data from devices that will help you identify devices as well. Many HTTP connections carry visible data that can make it possible to fingerprint the client device that sourced the data you capture. If you have the ASA setup to use some of the more advanced features such as Firepower you can also potentially decrypt and dissect some SSL traffic, maybe.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.