Ambiguous command error adding host to object-group

[cmcbride]

When attempting to add a host to an object group I'm getting an 'ambiguous command' error.  This is on an 8.2.4 ASA 5510, and ASDM 6.4.1.   Here's the output from ASDM:

[OK] object-group network Optim
      object-group network Optim
[ERROR] network-object host 172.20.15.211
     % Ambiguous command:  "network-object host 172.20.15.211"

[ERROR] network-object host 172.20.15.212
     % Ambiguous command:  "network-object host 172.20.15.212"

Doing it from the CLI gives the same error.

Specifying the host as "network-object 172.20.15.211 255.255.255.255" does work fine without any error.

Any ideas why?  I've not seen this before.  We had this error on 8.0.x and upgraded to 8.2.4 thinking it might fix the problem, but it hasn't...

[PAUL GILBERT ARIAS]

the sintax looks fine.

Have you tested with a new object-group?

I just tested it and worked fine.

[cmcbride]

Nope, on this ASA new object groups have the same problem:

sso-fw(config)# object-group network testing
sso-fw(config-network)# network-object host 10.1.1.1
ERROR: % Ambiguous command:  "network-object host 10.1.1.1"
sso-fw(config-network)#

I have other ASA's and they work fine with this.  Is there some setting that might be causing this behavior?

[PAUL GILBERT ARIAS]

at the moment I can only think of a possible software bug. Have you tried reloading the unit or using a different version on the same hardware?

If you are going to reload do it out of production hours.

try looking at the software bug toolkit:

http://tools.cisco.com/Support/BugToolKit/action.do?hdnAction=searchBugs

or if possible checking with the TAC.

[cmcbride]

Except for the fact that we had the same error running 8.0.4 and I rebooted to apply the update to 8.2.4 only to continue to get the error....  It could be a bug or something odd in the config.  Thanks for checking.  I'll have to see if we have smartnet or not on that ASA.

[mirober2]

Hello,

I would recommend checking your configuration to see if you have anything else that would cause the parser to consider that line ambiguous.Can you post a sanitized copy of your configuration so we can try to find the culprit?

If you use the ? help at each step of the command, which part does the ASA consider ambiguous?

-Mike

[cmcbride]

Here's the output from using ? during the command input:

sso-fw(config)# object-group network testing

sso-fw(config-network)# network-object ?  

network-object-group mode commands/options:
   Hostname or A.B.C.D  Enter an IPv4 network address
   X:X:X:X::X/<0-128>   Enter an IPv6 prefix
   host                 Enter this keyword to specify a single host object

sso-fw(config-network)# network-object host ?
ERROR: % Ambiguous command:  "network-object host "

Attached is the config.  Thanks.

[PAUL GILBERT ARIAS]

is it possible for you add a name for the IP you want to add in the object-group and then test again.

For example:

name 172.20.15.211 TEST_OJ

object-group nertwork TEST

network-object host TEST_OJ

or try disabling names and then test again. You can disable it by using the command " no names"

[mirober2 · Accepted solution]

Hello,

The problem is this line:

name 192.168.139.21 Host

Because the name is the same as the "host" keyword in the network-object command, the command parser reports this as an ambiguous command. I would recommend removing or renaming that line to avoid this issue.

Hope that helps.

-Mike

[cmcbride]

That was it!  Thanks so much.  I had never seen that before and didn't realize that having a named object called "host" would cause so much problems.  It makes sense though.  The system thought I was refering to the object "host" and wanted a subnet mask following, not an IP.