0

On a Cisco ASA 5505, software version 8.0.4, how can I use an enhanced service list in an access rule?

object-group service MY-SERVICES 
 description ports to allow through firewall for sitecore
 service-object tcp www
 service-object tcp https
 service-object tcp ssh
 service-object icmp echo
 service-object icmp echo-reply
exit

When I try to use it I get the following:

access-list inside_access_in extended permit ip object-group NETWORK1 object-group  NETWORK2   object-group MY_SERVICES
                                                                                               ^
ERROR: % Invalid Hostname

What is the syntax needed to use an extended service list (which includes multiple protocols, TCP and ICMP in this case) in an acces-list rule? The Cisco example only shows it being used in a basic access list.

1 Answer 1

1

Your object-group mix icmp and tcp so you can't place it at the end of the access-list where a port number is generally placed. Try to put your object group at the place where you put 'ip'

like:

access-list inside_access_in extended permit object-group MY_SERVICES object-group NETWORK1 object-group NETWORK2
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .