Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

ASA 5510 & Object-groups

I have an ASA 5510 and have just started using object-groups which are super handy in theory, but not working in reality. I have a service object-group with a mix of tcp, icmp, and udp ports. Let's call it Sample_Port_Group. I'm trying to apply it to my dmz_access_in ACL. Here's the line giving me problems:

access-list dmz_access_in extended permit object-group Sample_Port_Group 192.168.1.1 any

The asa throws up an error between 192.168.1.1 and any. When I put up a ? after Sample_Port_Group, it gives me the option of putting in an IP address, any, etc. When I put in a ? after 192.168.1.1, it only gives me the option of putting in an IP address.

Going off these posts:

- http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00800d641d.shtml

- http://www.cisco.com/en/US/docs/security/asa/asa81/config/guide/nwaccess.html

Those posts gave me the impression my line was possible, especially the "access-list outsideacl extended permit object-group myaclog interface inside any" line, which is at the end of the 2nd article linked.

What am I doing wrong?

Thanks in advance for any help.

Everyone's tags (4)
1 ACCEPTED SOLUTION

Accepted Solutions
New Member

ASA 5510 & Object-groups

Hi Adam!

You are doing it right, you are just missing on little keyword.

The line should be as this:

access-list dmz_access_in extended permit object-group Sample_Port_Group host 192.168.1.1 any

or you could specify the subnetmask as:

access-list dmz_access_in extended permit object-group Sample_Port_Group 192.168.1.1 255.255.255.255 any

Regards

2 REPLIES
New Member

ASA 5510 & Object-groups

Hi Adam!

You are doing it right, you are just missing on little keyword.

The line should be as this:

access-list dmz_access_in extended permit object-group Sample_Port_Group host 192.168.1.1 any

or you could specify the subnetmask as:

access-list dmz_access_in extended permit object-group Sample_Port_Group 192.168.1.1 255.255.255.255 any

Regards

New Member

ASA 5510 & Object-groups

That was simple, thanks for another pair of eyes to take a look at it!

621
Views
0
Helpful
2
Replies