Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a Cisco ASA 5505, software version 8.0.4, how can I use an enhanced service list in an access rule?

object-group service MY-SERVICES 
 description ports to allow through firewall for sitecore
 service-object tcp www
 service-object tcp https
 service-object tcp ssh
 service-object icmp echo
 service-object icmp echo-reply

When I try to use it I get the following:

access-list inside_access_in extended permit ip object-group NETWORK1 object-group  NETWORK2   object-group MY_SERVICES
ERROR: % Invalid Hostname

What is the syntax needed to use an extended service list (which includes multiple protocols, TCP and ICMP in this case) in an acces-list rule? The Cisco example only shows it being used in a basic access list.

share|improve this question
up vote 1 down vote accepted

Your object-group mix icmp and tcp so you can't place it at the end of the access-list where a port number is generally placed. Try to put your object group at the place where you put 'ip'


access-list inside_access_in extended permit object-group MY_SERVICES object-group NETWORK1 object-group NETWORK2
share|improve this answer
Perfect, thank you. – DrStalker Oct 7 '09 at 0:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.