using different service port in access rules

M Mohammed — Fri, 21 Feb 2020 15:05:32 GMT

Hi,

I am configuring an access rule where i have created a service port tcp/udp 3389 and in addition to that i am adding icmp group port (0, 3 and 😎 but i am getting an error message

"service cannot contain services of different types"

any advise?

thanks

Re: using different service port in access rules

er.shivamdubey31190 — Mon, 08 Jan 2018 14:17:05 GMT

Hi Mohammed,

You can not use both tcp and icmp service in same access control entry.

You can create seperate objects for tcp and icmp service and can call them in seperate access control entries.

Please let me know if you have any concern.

The only way out is :-

To create a protocol group for TCP, UDP, and ICMP, enter the following commands:

hostname (config)# object-group protocol tcp_udp_icmp

hostname (config-protocol)# protocol-object tcp

hostname (config-protocol)# protocol-object udp

hostname (config-protocol)# protocol-object icmp

and then use this protocol object in ACL.

For detailed info please refer to below link: -

https://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/objectgroups.html#wp1098519

Please mark this post as post as helpful and accept it as solution if it resolves your concern.

shivdube

EX-CISCO TAC Engg

topic using different service port in access rules in Network Security

using different service port in access rules

Re: using different service port in access rules