topic Re: Acess-list with an object-group in Network Security

Acess-list with an object-group

tdalago911 — Mon, 11 Mar 2019 12:22:16 GMT

I have a pix515e ver 6.3

I defined a object-group

eg. pix1(config)#obect-group network mxly

network-object 200.65.23.0 0.0.0.0

network-object """"" " "

network-object 202.65.30.0 0.0.0.0

pix(config)#access-list outside_acl permit tcp mxly 67.90.0.34 eq 25

the error is invalid ip address mxly.

How can I use or what is the correct context to use the object-group in my access-list as the source.

Thanks

derrickc — Wed, 26 Mar 2008 02:03:01 GMT

For the network-object command, use a network mask. For example:

network-object 200.65.23.0 255.255.255.0

It looks as if you are trying to use a wildcard mask.

Other than that, it looks fine.

Jon Marshall — Wed, 26 Mar 2008 07:29:22 GMT

In addition to previous post you need to modify your acl ie.

access-list outside_acl permit tcp mxly 67.90.0.34 eq 25

should be

access-list outside_acl permit tcp object-group mxly host 67.90.0.34 eq 25

HTH

Jon

derrickc — Wed, 26 Mar 2008 13:39:45 GMT

Good call....I should have caught that as I use object groups all of the time.

tdalago911, did this fix your problem?