Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On a Cisco ASA 5505, software version 8.0.4, how can I use an enhanced service list in an access rule?

object-group service MY-SERVICES 
 description ports to allow through firewall for sitecore
 service-object tcp www
 service-object tcp https
 service-object tcp ssh
 service-object icmp echo
 service-object icmp echo-reply
exit

When I try to use it I get the following:

access-list inside_access_in extended permit ip object-group NETWORK1 object-group  NETWORK2   object-group MY_SERVICES
                                                                                               ^
ERROR: % Invalid Hostname

What is the syntax needed to use an extended service list (which includes multiple protocols, TCP and ICMP in this case) in an acces-list rule? The Cisco example only shows it being used in a basic access list.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Your object-group mix icmp and tcp so you can't place it at the end of the access-list where a port number is generally placed. Try to put your object group at the place where you put 'ip'

like:

access-list inside_access_in extended permit object-group MY_SERVICES object-group NETWORK1 object-group NETWORK2
share|improve this answer
    
Perfect, thank you. –  DrStalker Oct 7 '09 at 0:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.