topic Re: - object just contains a in Network Security

Difference between object and object group

mahesh18 — Tue, 12 Mar 2019 04:12:44 GMT

Hi Everyone,

ASA1# sh run object
object network Sales
subnet 10.12.12.0 255.255.255.0

ASA1# sh run object-group
object-group service 123
service-object udp source eq 1900
object-group service 1900 udp
port-object eq 1900
object-group network sales
network-object 10.12.12.0 255.255.255.0
object-group network vpn_pool_ip
network-object 10.10.10.0 255.255.255.0
object-group network inside
network-object 10.0.0.0 255.255.255.0
network-object 192.168.50.0 255.255.255.0
network-object 10.1.0.0 255.255.0.0
object-group network VPN_Access
network-object 10.10.10.0 255.255.255.0
object-group service DNS_servers
service-object udp destination eq domain
object-group network DNS_SERVERS
network-object host 64.59.144.19
network-object host 4.2.2.2
object-group network FTP_EPSON
network-object host 63.73.69.140
network-object host 69.164.87.20
network-object host 69.164.87.37

Need to understand what is difference between object and object group here?

as under object network we can have host,subnet or range of IP addresses but object group can also have IP addresses under it.

Regards

MAhesh

- object just contains a

Jennifer Halim — Mon, 19 May 2014 01:41:59 GMT

- object just contains a single type of object, whether it's network object (single IP address or subnet), or service object (tcp port(s), protocol, udp port(s)).

- object group contains a group of objects, so you can combine all the same type of objects into a group, eg: a single IP, subnets, different subnets, different IP into one network object-group.

Hi Jennifer, i tested and

mahesh18 — Mon, 19 May 2014 02:18:49 GMT

Hi Jennifer,

i tested and found that object contains single variable it can be either IP,subnet or range.

i tested it as below

ASA1# sh run object
object network Test1
host 8.8.8.8
ASA1# config t
ASA1(config)# obj
ASA1(config)# object net
ASA1(config)# object network Test1
ASA1(config-network-object)# host 3.3.3.3
ASA1(config-network-object)# sub
ASA1(config-network-object)# subnet ?

network-object mode commands/options:
A.B.C.D Enter an IPV4 network address
X:X:X:X::X/<0-128> Enter an IPv6 prefix
ASA1(config-network-object)# subnet 2.2.2.0 255.255.255.0
ASA1(config-network-object)# end
ASA1# sh run obh
ASA1# sh run obj
ASA1# sh run object
object network Test1
subnet 2.2.2.0 255.255.255.0

I understand it now.

Best Regards

MAhesh

Re: - object just contains a

Eddy.Cuevas — Tue, 12 Jun 2018 14:17:30 GMT

Nice explanation, thank you Jennifer!