topic Cisco ASA 5510 CLI configuration in Network Security

Cisco ASA 5510 CLI configuration

Kaushik Ray — Tue, 12 Mar 2019 05:38:45 GMT

Hello I am trying to create an object with a public IP address as a host and allow multiple udp ports to that host but cannot fine to seem the relevant documentation.

When i create the object and try the service command under it does not allow me to put in udp/tcp protocol options.

Any one can advise on how to configure this please?

device details

PID: ASA5510

System image file is "disk0:/asa842-k8.bin"

Please let me know if you need any more details.

thanks

Hi Kaushik,This is how you

Kanwaljeet Singh — Mon, 16 Mar 2015 14:21:50 GMT

Hi Kaushik,

This is how you define the object service:

object service test-list

service tcp source eq 8014

And below are the options. You cannot define all three of the below ports in one service. You can define range or equal or greater than etc.

ASA5585-2(config-service-object)# service tcp source ?

service-object mode commands/options:

eq Port equal to operator

gt Port greater than operator

lt Port less than operator

neq Port not equal to operator

range Port range operator

Then you can use this object service in access-list or NAT rule.

Regards,

Kanwal

Note: Please mark answers if they are helpful.

thanks I have setup something

Kaushik Ray — Mon, 16 Mar 2015 14:34:56 GMT

thanks I have setup something like this. is it fine or i need to amend something ?

Please let me know thanks

object network obj-Test
host xxx.xxx.xxx.xxx

object network obj-Test
nat (inside,outside) static xxx.xxx.xxx.xxx

access-list outside_acl extended permit ip host yyy.yyy.yyy.yyy host xxx.xxx.xxx.xxx
access-list outside_acl extended permit ip host aaa.aaa.aaa.aaa host xxx.xxx.xxx.xxx

access-list outside_acl extended permit udp any host xxx.xxx.xxx.xxx range 20000 24000

Hi Kaushik,I am not sure

Kanwaljeet Singh — Mon, 16 Mar 2015 22:07:47 GMT

Hi Kaushik,

I am not sure about your requirement but this command should allow udp access for the host and range you have mentioned.

Regards,

Kanwal

Note: Please mark answers if they are helpful.

Thanks Kanwal for your reply;

Kaushik Ray — Mon, 16 Mar 2015 23:41:11 GMT

Thanks Kanwal for your reply; one more thing i wanted to ask ; my host has been assigned a public ip address itself; in that case am i correct in doing a static nat to itself or that could cause issues?

Hi Kaushik,Yeah it should be

Kanwaljeet Singh — Wed, 18 Mar 2015 14:27:03 GMT

Hi Kaushik,

Yeah it should be fine if it is not natted anywhere else.

Regards,

Kanwal

Note: Please mark answers if they are helpful.