Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

add network object to access list

Can someone please show me how to add existing network objects to existing access control lists in a network object group using the cli in the asa version 9.x on the inside interface? The source is an already existing network object and the destination is an existing network object group. Thanks.

Everyone's tags (1)
1 ACCEPTED SOLUTION

Accepted Solutions
Super Bronze

Re: add network object to access list

Hi,

Well if the existing "access-list" rule has an "object-group network " as the destination and you want to add another host to the "object-group" then you could do this

object-group network

  network-object host

- Jouni

4 REPLIES
Super Bronze

add network object to access list

Hi,

I am not entirely sure of what you are asking.

What I undertood is that you have the following already

  • An "access-list" that is attached to the "inside" interface
  • An existing "object network " configured that will be used as the source for the "access-list" rule
  • An existing "object-group network " configured that will be used as the destination for the "access-list" rule

If the above is true then you would simply configure

access-list permit ip object object-group

The above though would permit all TCP/UDP traffic

If you want to only allow specific ports for either TCP or UDP then you would use the format

access-list permit tcp object object-group eq

access-list permit udp object object-group eq

Naturally if you want to allow multiple ports there would be further ways to group those ports together also inside "object-group" to make the configuration smaller/cleaner.

Please let me know if you were looking for something else and I missunderstood

Hope this helps

- Jouni

add network object to access list

close..but when I did that command access-list permit tcp object object-group eq

All it did was create a duplicate of what already existed.

Sorry for not explaining well enough.

What I want to do is add a host (server) to a network object group that already exists in an acl.

Inside interface

rule# 15 - source is a network object (just a server) and the destination is a network object group.

I want to add a host to the network object group.

Thanks again.

Super Bronze

Re: add network object to access list

Hi,

Well if the existing "access-list" rule has an "object-group network " as the destination and you want to add another host to the "object-group" then you could do this

object-group network

  network-object host

- Jouni

add network object to access list

Thanks that did it.

187
Views
0
Helpful
4
Replies
CreatePlease login to create content