topic What object group a port is in? in Network Security

What object group a port is in?

Hamood Rehman — Tue, 12 Mar 2019 00:37:20 GMT

The following does not help:

ASA# sho run object-g | in 1433

port-object eq 1433

service-object tcp eq 1433

port-object eq 1433

ASA# sho run object-g service | in 1433

port-object eq 1433

service-object tcp eq 1433

ASA# sho run object-g | be 1433

port-object eq 1433

ASA# sho run object-g | grep 1433

port-object eq 1433

service-object tcp eq 1433

port-object eq 1433

What object group a port is in?

Eugene Korneychuk — Fri, 14 Dec 2012 22:38:33 GMT

Hello,

Try this one:

sh run object service in-line | i 1433

Please rate helpful posts

Best Regards,

Eugene

What object group a port is in?

Hamood Rehman — Fri, 14 Dec 2012 22:52:49 GMT

ASA# sho run object-g service in-line | in 1433

ERROR: % Invalid input detected at '^' marker.

ASA#

What object group a port is in?

Eugene Korneychuk — Fri, 14 Dec 2012 23:15:19 GMT

Hello,

With command which I specified you can find an object which contains a service,

sh run object service in-line | i 1433

To find an object-group which contains 1433, will be easier in ASDM:

I attached a screenshot

What object group a port is in?

Hamood Rehman — Sat, 15 Dec 2012 04:40:16 GMT

I issued the command and firewall pointed to an error after the word service, meaning "in-line" is not one of the commands it expects after the word "service"

What object group a port is in?

Eugene Korneychuk — Sat, 15 Dec 2012 08:34:12 GMT

So what is the ASA version? Answer for object-group is ASDM.

Best Regards,

Eugene

What object group a port is in?

Hamood Rehman — Mon, 11 Feb 2013 22:20:53 GMT

Here's the command to find the object group name a port is in:

ASAXXX# show run object-group | in object-group | time-exceeded

object-group icmp-type ICMP_SVCS

icmp-object time-exceeded

Now you can find what else is in that object group:

ASAXXX# sho run object-group id ICMP_SVCS

object-group icmp-type ICMP_SVCS

icmp-object echo-reply

icmp-object unreachable

icmp-object echo

icmp-object time-exceeded

icmp-object traceroute

and the access-list that object group is being used in:

ASAXXX# sho access-list | in ICMP_SVCS

access-list Access_List_Name line 5 extended permit icmp object-group ABCD object-group WXYZ object-group ICMP_SVCS

So if you know a port number, you can quickly find out what object group and what access list is allowing that port.