topic ACL syntax problem in Network Security

ACL syntax problem

Colin Higgins — Tue, 12 Mar 2019 03:20:11 GMT

I have a ASA services modules in a 6509-E that is giving me issues with ragards to ACL syntax

Let's say I have a KMS server at 192.168.20.10

I want to allow all hosts to reach this server at port tcp 1688

so I do

object-group network KMS-SERVERS

host 192.168.20.10

then

access-list KMS-ACCESS-IN extended permit tcp any object-group KMS-SERVERS eq 1688

problem is, it WILL NOT take the "eq 1688"

this was a valid command in other IOS versions. Why isn't it working now?

Karsten Iwen — Wed, 18 Dec 2013 17:35:45 GMT

Is that really what you configured? Your object-group doesn't look like that what you show here is what you did on your ASA.

Please verify and show the exact terminal-output.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

Colin Higgins — Wed, 18 Dec 2013 17:38:56 GMT

well that is my question

the command

access-list KMS-ACCESS-IN extended permit tcp any host 192.168.20.10 eq 1688

will work

access-list KMS-ACCESS-IN extended permit tcp any object-group KMS-SERVERS eq 1688

will not

I don't get any options after the object group

this used to work

Karsten Iwen — Wed, 18 Dec 2013 17:48:26 GMT

that is typically the case if the object-group is not available. Thats the reason I asked what you *really* configured on your box.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni