miscancellous config examples for object-group
misc templates
In the 7.x releases a service object group could only contain entries for a single protocol (TCP, UDP, or both TCP/UDP). This forced admins to either use a separate object group for TCP and UDP ports (requiring two ACE entries), or to match more ports than necessary (by using the tcp-udp type).
simple example from cisco config guide (old style)
object-group service services1 tcp-udp description DNS Group port-object eq domain object-group service services2 udp description RADIUS Group port-object eq radius port-object eq radius-acct object-group service services3 tcp description LDAP Group port-object eq ldap
Here you can see the use of tcp, udp and a combined object-group. This is the common style since version 7.x. Use it if you have to be compatible with older versions and with most admins, since this is still prefered style in most guides including from cisco.
Enhanced service object group since version 8.0
The 8.0 release of the ASA software solves this problem by introducing an enhanced Service object group that allows a mix of multiple protocols within the same group. Unfortunately, the 8.0, 8.2 and 8.4 ASA configuration guides dont appear to cover this new type of service group or show an example.
object-group network DmzNet network-object 192.168.1.0 255.255.255.0 ! object-group service DmzServices service-object icmp service-object tcp eq 80 service-object udp eq 123 service-object udp eq 53 service-object tcp eq 53 ! access-list Dmz extended permit object-group DmzServices any object-group DmzNet
example from a real live config
object-group service sAddLdap tcp description -- LDAP-queries port-object eq ldap port-object eq ldaps object-group service sAddNetbiosTcp tcp description -- TCP for CIFS port-object eq 445 port-object eq netbios-ssn object-group service sAddNetbiosUdp udp description -- UDP for CIFS port-object eq netbios-dgm port-object eq netbios-ns object-group service sBaseTcp tcp description -- TCP base services for Clients port-object eq domain port-object eq www port-object eq https port-object eq imap4 port-object eq pop3 port-object eq smtp port-object eq ssh port-object eq 17 port-object eq 587 port-object range 1600 1601 port-object eq nntp port-object eq 8080 port-object eq 8081 port-object eq 3128 port-object eq 8070 port-object eq citrix-ica port-object eq ident object-group service sBaseUdp udp description -- UDP base services for Clients port-object eq domain port-object eq ntp port-object eq isakmp port-object eq 427 object-group service sSrvSshTcp tcp description -- Fernadministration via ssh, scp, sftp port-object eq ssh object-group network nCampus description -- hole campus network-object 134.32.0.0 255.255.0.0 object-group network nCampusServer description -- Basisserver (time, web, dns, Backup) network-object host 134.32.4.237 network-object host 134.32.140.52 network-object host 134.32.140.57 network-object host 134.32.140.69 network-object host 134.32.8.18 network-object host 134.32.8.19 network-object host 134.32.8.2 network-object host 134.32.8.3 network-object host 134.32.8.43 network-object host 134.62.1.108 object-group service sSpzBackupTcp tcp description -- Backup only port-object range 1600 1601 object-group service stSpzMail tcp description -- Mail only port-object eq 587 port-object eq smtp object-group service stSpzWeb tcp description -- Web only port-object eq www port-object eq https object-group icmp-type sIcmpBase description -- Ping u.A. icmp-object conversion-error icmp-object echo icmp-object echo-reply icmp-object parameter-problem icmp-object source-quench icmp-object time-exceeded icmp-object traceroute icmp-object unreachable object-group protocol sIpVpn description -- ESP for VPN protocol-object esp object-group service stAddLpr tcp description -- Printservice port-object eq 510 port-object eq lpd port-object eq 9100 port-object eq 9400 port-object eq 9200 object-group service suAddLpr udp description -- Addhoc noch UDP port-object eq 510 port-object eq 515 port-object eq 9100 port-object eq 9400 object-group service sAddVnc tcp description -- VNS Remote Managment port-object eq 5900 object-group service stAddMysql tcp description -- Databaseconnect for [[sysadmin:mysql|MySQL]] und ODBC port-object eq 3306 object-group service sAddGmail tcp description -- IMAP/SSL, SMTP/SSL for Gmail port-object eq 465 port-object eq 993 object-group protocol TCPUDP protocol-object udp protocol-object tcp object-group service stAddBeehive tcp port-object eq 7778 port-object eq 21401