topic Re: Ambiguous command error adding host to object-group in Network Security

Ambiguous command error adding host to object-group

cmcbride — Mon, 11 Mar 2019 19:46:01 GMT

When attempting to add a host to an object group I'm getting an 'ambiguous command' error. This is on an 8.2.4 ASA 5510, and ASDM 6.4.1. Here's the output from ASDM:

[OK] object-group network Optim
object-group network Optim
[ERROR] network-object host 172.20.15.211
% Ambiguous command: "network-object host 172.20.15.211"

[ERROR] network-object host 172.20.15.212
% Ambiguous command: "network-object host 172.20.15.212"

Doing it from the CLI gives the same error.

Specifying the host as "network-object 172.20.15.211 255.255.255.255" does work fine without any error.

Any ideas why? I've not seen this before. We had this error on 8.0.x and upgraded to 8.2.4 thinking it might fix the problem, but it hasn't...

Re: Ambiguous command error adding host to object-group

PAUL GILBERT ARIAS — Mon, 07 Feb 2011 18:07:06 GMT

the sintax looks fine.

Have you tested with a new object-group?

I just tested it and worked fine.

Re: Ambiguous command error adding host to object-group

cmcbride — Mon, 07 Feb 2011 19:40:55 GMT

Nope, on this ASA new object groups have the same problem:

sso-fw(config)# object-group network testing
sso-fw(config-network)# network-object host 10.1.1.1
ERROR: % Ambiguous command: "network-object host 10.1.1.1"
sso-fw(config-network)#

I have other ASA's and they work fine with this. Is there some setting that might be causing this behavior?

Re: Ambiguous command error adding host to object-group

PAUL GILBERT ARIAS — Mon, 07 Feb 2011 19:51:58 GMT

at the moment I can only think of a possible software bug. Have you tried reloading the unit or using a different version on the same hardware?

If you are going to reload do it out of production hours.

try looking at the software bug toolkit:

http://tools.cisco.com/Support/BugToolKit/action.do?hdnAction=searchBugs

or if possible checking with the TAC.

Re: Ambiguous command error adding host to object-group

cmcbride — Mon, 07 Feb 2011 21:27:57 GMT

Except for the fact that we had the same error running 8.0.4 and I rebooted to apply the update to 8.2.4 only to continue to get the error.... It could be a bug or something odd in the config. Thanks for checking. I'll have to see if we have smartnet or not on that ASA.

Re: Ambiguous command error adding host to object-group

mirober2 — Mon, 07 Feb 2011 21:56:23 GMT

Hello,

I would recommend checking your configuration to see if you have anything else that would cause the parser to consider that line ambiguous.Can you post a sanitized copy of your configuration so we can try to find the culprit?

If you use the ? help at each step of the command, which part does the ASA consider ambiguous?

-Mike

Re: Ambiguous command error adding host to object-group

cmcbride — Mon, 07 Feb 2011 22:27:12 GMT

Here's the output from using ? during the command input:

sso-fw(config)# object-group network testing

sso-fw(config-network)# network-object ?

network-object-group mode commands/options:
   Hostname or A.B.C.D Enter an IPv4 network address
   X:X:X:X::X/<0-128>   Enter an IPv6 prefix
   host                 Enter this keyword to specify a single host object

sso-fw(config-network)# network-object host ?
ERROR: % Ambiguous command: "network-object host "

Attached is the config. Thanks.

Re: Ambiguous command error adding host to object-group

PAUL GILBERT ARIAS — Mon, 07 Feb 2011 22:38:59 GMT

is it possible for you add a name for the IP you want to add in the object-group and then test again.

For example:

name 172.20.15.211 TEST_OJ

object-group nertwork TEST

network-object host TEST_OJ

or try disabling names and then test again. You can disable it by using the command " no names"

Re: Ambiguous command error adding host to object-group

mirober2 — Tue, 08 Feb 2011 13:08:03 GMT

Hello,

The problem is this line:

name 192.168.139.21 Host

Because the name is the same as the "host" keyword in the network-object command, the command parser reports this as an ambiguous command. I would recommend removing or renaming that line to avoid this issue.

Hope that helps.

-Mike

Re: Ambiguous command error adding host to object-group

cmcbride — Tue, 08 Feb 2011 15:04:21 GMT

That was it! Thanks so much. I had never seen that before and didn't realize that having a named object called "host" would cause so much problems. It makes sense though. The system thought I was refering to the object "host" and wanted a subnet mask following, not an IP.