topic Re: How do I add many subnets to asa? in Network Security

How do I add many subnets to asa?

Rick Morgan — Mon, 11 Mar 2019 20:30:47 GMT

My ASA

Cisco Adaptive Security Appliance Software Version 8.0(5)

Device Manager Version 6.2(5)53

Does anyone know how to add many IP subnets to an asa?

As an example lets say I want to create a group "country block list", and I have a block of subnets;

2.60.0.0/14

2.92.0.0/14

31.3.16.0/21

31.7.224.0/20

31.8.0.0/16

31.10.0.0/21

31.10.8.0/21

How do I add them as one group? Can this be done?

Thanks,

Rick

Re: How do I add many subnets to asa?

Dan-Ciprian Cicioiu — Mon, 09 May 2011 13:42:07 GMT

You can try using object-groups :

object-group network country

network-object 2.60.0.0 255.252.0.0

network-object 2.92.0.0 255.252.0.0

.....
and so on

I hope i understood well your question

Dan

Re: How do I add many subnets to asa?

varrao — Mon, 09 May 2011 13:43:46 GMT

Rick,

On the ASA you can create object-group and under a single object-group include all the different subnets, so a single object-group would represent the the complete subnets that you have. Just for your reference, have a look at the command reference:

http://www.cisco.com/en/US/partner/docs/security/asa/asa80/command/reference/no.html#wp1750094

Sample config:

hostname(config)# object-group network sjc_ftp_servers

hostname(config-network)# network-object host sjc.ftp.servers

hostname(config-network)# network-object host 172.23.56.195

hostname(config-network)# network-object 193.1.1.0 255.255.255.224

hostname(config-network)# group-object sjc_eng_ftp_servers

hostname(config-network)# exit


Hope this helps.

Thanks,
Varun

Re: How do I add many subnets to asa?

Rick Morgan — Mon, 09 May 2011 14:52:04 GMT

Ok I created a network group called blocked list. How do I add an ACL to this group to block all incomming WAN traffic to this group.

Thanks,

Rick

Re: How do I add many subnets to asa?

Dan-Ciprian Cicioiu — Mon, 09 May 2011 15:38:13 GMT

I dont think that the name of your object group could be "blocked list" - with space in the name.

To make use of the object-group in the access-list you must use "object-group blocked" ( if the name of the object-group is blocked) instead of using network and netmask pairs.

Dan

Re: How do I add many subnets to asa?

varrao — Mon, 09 May 2011 17:01:11 GMT

Here is a sample configuration that might ease out things for you:

access-list 104 permit ip host object-group A object-group B 

where A & B are the names of your object-group

Hope this helps.

Thanks,
Varun

Re: How do I add many subnets to asa?

Dan-Ciprian Cicioiu — Mon, 09 May 2011 17:18:49 GMT

varrao wrote:

access-list 104 permit ip host object-group A object-group B 

Thanks,
Varun

Hello Varun ,

I think that your command will not work.

Dan

Re: How do I add many subnets to asa?

varrao — Mon, 09 May 2011 17:33:47 GMT

ooopss.. sory for the typo