topic Re: ip service object and service group in Network Security

ip service object and service group

markus.demmert — Mon, 11 Mar 2019 20:34:27 GMT

Good day to all,

hope someone can help with my isssue.

When I create a service object or group and add the object to a new rule it never works.

I mean the traffic match not the rule. I see not hits.

I placed the rule on top of my access list to check if I do somethink wrong but it is not working. When I place only a service for example tcp/23 it is working.

my ip service object

object-group service g-as400
description access client 2 as400 machine
service-object tcp-udp destination eq 397
service-object tcp destination eq 137
service-object tcp destination eq 2001
service-object tcp destination eq 3000
service-object tcp destination eq 445
service-object tcp destination range 446 447
service-object tcp destination eq 449
service-object tcp destination eq 5010
service-object tcp destination eq 5544
service-object tcp destination eq 5555
service-object tcp destination range 8470 8476
service-object tcp destination eq 8480
service-object tcp destination eq exec
service-object tcp destination eq netbios-ssn
service-object tcp destination eq telnet

my rule

access-list FhbTrans_inside extended permit object-group g-as400 192.168.5.0 255.255.255.0 host 172.20.0.14

my asa details

ASA 5510 
Cisco Adaptive Security Appliance Software Version 8.4(1)
Device Manager Version 6.4(1)

Did somebody already have this problem? Many thanks for feedback!

Markus

Re: ip service object and service group

Pavel Pokorny — Tue, 17 May 2011 20:06:10 GMT

Hi,

https://supportforums.cisco.com/message/3353341

Are the symptoms the same?

Pavel

Re: ip service object and service group

Maykol Rojas — Tue, 17 May 2011 20:17:54 GMT

Hi,

Can you run a packet tracer like this?

packet-tracer input tcp 192.168.5.2 1025 host 172.20.0.14 397

Paste the output here.

Mike

Re: ip service object and service group

markus.demmert — Tue, 17 May 2011 20:30:01 GMT

Hi Pavel,

you correct. I see the hits in the console. But not the msg out of sync under firewall dashboard.

Markus

Re: ip service object and service group

Pavel Pokorny — Tue, 17 May 2011 20:33:23 GMT

Hi,

Then I suggest the same - open TAC case and let Cisco repair ASDM, or explain reason, why there is big zero in ASDM.

;-).

Regards

Pavel

Re: ip service object and service group

markus.demmert — Tue, 17 May 2011 20:38:52 GMT

Hi,

here is the output....seems ok for me.

fw-deham-1/act/pri# packet-tracer input FhbTrans_inside tcp 192.168.5.2 1025 ?

A.B.C.D Enter the destination ipv4 address
fw-deham-1/act/pri# packet-tracer input FhbTrans_inside tcp 192.168.5.2 1025 1$

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 0.0.0.0 0.0.0.0 FhbTrans_outside

Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group FhbTrans_inside in interface FhbTrans_inside
access-list FhbTrans_inside extended permit object-group g-as400 192.168.5.0 255.255.255.0 host 172.20.0.14 log
object-group service g-as400
description: access client 2 as400 machine
service-object tcp-udp destination eq 397
service-object tcp destination eq 137
service-object tcp destination eq 2001
service-object tcp destination eq 3000
service-object tcp destination eq 445
service-object tcp destination range 446 447
service-object tcp destination eq 449
service-object tcp destination eq 5010
service-object tcp destination eq 5544
service-object tcp destination eq 5555
service-object tcp destination range 8470 8476
service-object tcp destination eq 8480
service-object tcp destination eq exec
service-object tcp destination eq netbios-ssn
service-object tcp destination eq telnet
Additional Information:

Phase: 3
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 4
Type: FOVER
Subtype: standby-update
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 573563, packet dispatched to next module

Result:
input-interface: FhbTrans_inside
input-status: up
input-line-status: up
output-interface: FhbTrans_outside
output-status: up
output-line-status: up
Action: allow

Markus

Re: ip service object and service group

markus.demmert — Tue, 17 May 2011 20:39:41 GMT

many thanks Pavel,

will do this.

Markus

Re: ip service object and service group

Maykol Rojas — Tue, 17 May 2011 20:46:43 GMT

Thats what I needed, here is the bug ID CSCtl99214

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtl99214

Hope it helps.

Mike

Re: ip service object and service group

markus.demmert — Tue, 17 May 2011 21:10:47 GMT

Thanks for the link. But where I can download the fix. I dont found it in the download area.

Markus