see an example using object-group service

see an example using object-group service



I would like to see an example using object-group service command with  the following


object service name: management

for services : ssh,dns,ntp,ldap,syslog,snmp,smtp

ACL: then apply it from lower security30 (dmz1) on 10.30.44.0/24 to a higher (inside) security100 10.30.31.0/24
cogitAsked:
Who is Participating?
 
lrmooreConnect With a Mentor Commented:
I don't know why that would not work.
You can also group your networks. This is just an example only:

name 10.30.32.0 DOT32
name 10.30.33.0 DOT33
name 10.30.34.0 DOT34
name 10.30.54.0 DOT54
name 10.30.64.0 DOT64

object-group network LOWSECURITY
  network-object DOT32 255.255.255.0
  network-object DOT33 255.255.255.0
  network-object DOT34 255.255.255.0

object-group network HIGHSECURITY
  network-object DOT54 255.255.255.0
  network-object DOT64 255.255.255.0



access-list dmz_in permit object-group typeofprotocol object-group LOWSECURITY object-group HIGHSECURITY object-group management

0
 
lrmooreCommented:
Sure...

name XX.XX.XX.25 APROHEAT02
name XX.XX.XX.24 APROHEAT01
!
object-group service HEAT tcp
  port-object eq www
  port-object eq https
  port-object eq 491
!
object-group network HEAT_SRVRS
  network-object APROHEAT01 255.255.255.255
  network-object APROHEAT02 255.255.255.255
!
access-list inbound permit tcp any object-group HEAT_SRVRS object-group HEAT
!
access-group inbound in interface outside
0
 
lrmooreCommented:
Here's one the reverse:

object-group service User_Outbound tcp
  port-object eq telnet
  port-object eq www
  port-object eq ssh
  port-object eq ftp-data
  port-object eq https
  port-object eq ftp
!
access-list outbound permit tcp any any object-group User_Outbound
access-list outbound permit udp host <dns server> any eq domain
access-group outbound in interface inside
0
 
cogitAuthor Commented:
this work?

object-group protocol typeofprotocol
protocol-object tcp
 protocol-object udp
S# exit
S# object-group service management tcp-udp
port-object eq 22
port-object eq 53
port-object eq 123
port-object eq 389
port-object eq 514
port-object eq 161
port-object eq 25
(config-service)#  exit


access-list vlan32_out permit object-group typeofprotocol 10.30.32.0 255.255.255.0 10.30.31.0 255.255.255.0  object-group  management
access-list vlan33_out permit object-group typeofprotocol 10.30.33.0 255.255.255.0 10.30.31.0 255.255.255.0  object-group  management
access-list vlan34_out permit object-group typeofprotocol 10.30.34.0 255.255.255.0 10.30.31.0 255.255.255.0  object-group  management
access-list v44_out permit object-group typeofprotocol 10.30.44.0 255.255.255.0 10.30.31.0 255.255.255.0  object-group  management
access-list v54_out permit object-group typeofprotocol 10.30.54.0 255.255.255.0 10.30.31.0 255.255.255.0  object-group  management
access-list v64_out permit object-group typeofprotocol 10.30.64.0 255.255.255.0 10.30.31.0 255.255.255.0  object-group  management
access-group vlan32_out in interface vlan32
access-group vlan33_out in interface vlan33
access-group vlan34_out in interface vlan34
access-group v44_out in interface v44
access-group v54_out in interface v54
access-group v64_out in interface v64


0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.