ASA 5500-X using ASDM 7.3.101 edit object-group deletes access-list

[Rodrigo Belo]

Hi all,

I have an object-group (OBJ-Customers) with multiple other object-groups (OBJ-client01; OBJ-client02...etc).

When I was adding a new object (OBJ-client0Z) to the main OBJ-Customers, every access-list that had OBJ-Customers got deleted.

Now, when I try to add any objects to OBJ-Customers I get an access-list error (file attached), even thow OBJ-Customers is not on any access-list.

Plus, I cannot create any new access-list with OBJ-Customers (it dosent error but the access-list just doesn`t get created, both with ASDM and CLI).

How can I troubleshoot/debug this?

Can anywone help me out please??

[Vibhor Amrodia]

Hi,

What is the ASA device version ?

Are you using this command on the ASA device:-

object-group-search access-control

Thanks and Regards,

Vibhor Amrodia

[Rodrigo Belo]

Cisco Adaptive Security Appliance Software Version 9.2(2)4
Device Manager Version 7.3(1)101

Yes, I didn`t realised it but I am using "object-group-search access-control" !

Is this a bad thing??

Can the Firewall be hitting some sort of limit with this??

And if so, how can I check it??

"You can reduce the memory required to search access rules by enabling object group search, but this is at the expense rule lookup performance. When enabled, object group search does not expand network objects, but instead searches access rules for matches based on those group definitions. You can set this option using the object-group-search access-control command."

http://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/firewall/asa-firewall-cli/access-rules.html

Thanks

[Vibhor Amrodia · Accepted solution]

Hi,

You are running in this Defect:- CSCup28968

I would recommend an upgrade. This command might be important if you have large number of ACE expanded because of the object groups.

If you don't have those many ACL's , you can probably remove it.

Thanks and Regards,

Vibhor Amrodia

[Rodrigo Belo]

That was a great pointer Vibhor...

I may be hitting BUG CSCup28968.

https://tools.cisco.com/bugsearch/bug/CSCup28968

I will schedulle an change and/or upgrade and let you know later on.

How bad (in performance I mean) would it be if I turned off "object-group-search access-control"?

Feel free to give any other opinion you may have.

Thanks