Allowing access for multiple ports across ASA 5506, TCP and UDP

[Pete Johnstone]

So I need to allow a server in the DMZ to talk to a domain controller on the internal network for authentication.  This requires allowing a bunch of protocols through the firewall, some googling I think has given me a comprehensize list.

That said, how do I enter the access-list rules on the firewall, it's an ASA 5506.  I know how to create a rule for a single port, and multiple ports if they're all TCP or UDP.  But the list of ports in some cases I'll need TCP/UDP for one port, and other cases only TCP and NOT UDP for a port, etc.

For example:

port 88 TCP/UDP

port 636 TCP only

port 464 TCP/UDP 

and so on

Or is the only way to do this with multiple access-list entries?

[Flavio Miranda]

You dont.

 Always work with object-group when you have list of port or IP address.

object-group service "name" tcp-udp

port-object eq port1

port-object eq port2

port-object eq portn

port-object range portx porty

Then, apply this object-group on your rule.

[Spooster IT Services · Accepted solution]

Hi Pete,

You can create object group for services and mention the protocol which you want to allow. Then use this object group in the Access list. Example is given as below:

object-group service SERVICES
service-object tcp-udp destination eq 88
service-object tcp destination eq 636
service-object tcp-udp destination eq 464
!
object-group DMZ_SERVER
network-object host <IP of DMZ server>
!
object-group DOMAIN_CONTROLLER
network-object host <IP of Domain Controller>
!
access-list DMZ_ACCESS_IN extended permit object-group SERVICES object-group DMZ_SERVER object-group DOMAIN_CONTROLLER

If this was helpful, please give it a thumbs up