topic Cannot Modify a Service Object-Group in Network Security

Cannot Modify a Service Object-Group

ronbuchalski — Tue, 12 Mar 2019 02:57:05 GMT

We have an ASA 5540 running ASA v 8.4(7). I am attempting to edit an existing service object-group, to add a few additional ports. However, when I attempt to do so, I get one of two problems.

If I type 'object-group service FOO' and enter it, I get:

An object-group with the same id but different type (service) exists

If I type 'object-group service FOO tcp and enter it, the ASA accepts the command, and the cursor drops to the next line, but I receive no prompt, and whatever I type in does not echo on the screen. It's like the ASA goes into the Twilight Zone.

I can log into the ASA with another SSH session, so it's not like the ASA is locked up.

Any ideas about this one?

Thanks in advance,

-rb

Cannot Modify a Service Object-Group

jumora — Tue, 29 Oct 2013 01:30:20 GMT

Please run the next command:

show run object id FOO

Please send the output so I can understand what is going on.

Cannot Modify a Service Object-Group

jumora — Tue, 29 Oct 2013 01:30:50 GMT

And also:

show run object-g id FOO

Cannot Modify a Service Object-Group

ronbuchalski — Tue, 29 Oct 2013 14:39:02 GMT

I found what the problem was. The primary and secondary ASAs were no longer in sync with the configuration, so it wouldn't let me change anything. But it didn't warn me either.

I failed over to the secondary, and rebooted the primary, and they re-synced configurations. Then I was able to change the object-group, as expected.

Thanks for your assistance.

-rb

Cannot Modify a Service Object-Group

jumora — Tue, 29 Oct 2013 17:39:26 GMT

Thank you for the update!!!

Cannot Modify a Service Object-Group

jumora — Thu, 31 Oct 2013 17:49:45 GMT

Please update the ticket as resolved or answered so we can close out followup.