I noticed a new odd behaviour of ASA 9.18.4.22. Object-group and object duplicate and dependency checks no longer work. It used to complain when one edits an object-group and adds an object that already existed. Now nothing shown at all. Also it used to complain when deleting an object that it could not be deleted because it was still in use by an object-group or an access-list.
firewall1/context2/act# show run object-group id Some-Object-Group
object-group network Some-Object-Group
network-object 1.0.0.0.0 255.0.0.0
network-object 2.0.0.0.0 255.0.0.0
network-object 3.0.0.0.0 255.0.0.0
firewall1/context2/act# conf t
firewall1/context2/act(config)# object-group network Some-Object-Group
firewall1/context2/act(config-network-object-group)# network-object 3.0.0.0.0 255.0.0.0
firewall1/context2/act(config-network-object-group)# exit
On a firewall with an older release (e.g. Version 9.16(3)23) adding a duplicate network-object shows a warning like this:
WARNING: Adding obj (network-object 3.0.0.0 255.0.0.0) to grp (Some-Object-Group) failed; object already exists
Don't know if that was before on that version, but definitely not on a version prior to 9.18.4.x. We don't have this behaviour on ASA firewalls running 9.16.x.
On ASA 9.18.4.24 deleting an network-object that was used in an object-group showed no error that the network-object is still used in an object-group. Instead ASA adds a duplicate network-object in same object-group:
firewall1/context2/act(config)# show run object-group id dummy-group-1
object-group network dummy-group-1
network-object object dummy-object-1
network-object object dummy-object-2
firewall1/context2/act(config)# show run object id dummy-object-1
object network dummy-object-1
host 1.0.0.0
firewall1/context2/act(config)# show run object id dummy-object-2
object network dummy-object-2
host 2.0.0.0
firewall1/context2(config)# no object network dummy-object-1
firewall1/context2(config)# show run object-group id dummy-group-1
object-group network dummy-group-1
network-object object dummy-object-1
network-object object dummy-object-2
network-object object dummy-object-1
Removing duplicate causes firewall to panic and reboot.
firewall1/context2/act(config)# object-group network dummy-group-1
firewall1/context2/act(config-network-object-group)# no network-object object dummy-object-1
Coredump starting....
Corehelper: /opt/cisco/csp/cores/core.lina.10.1266.1717407923
Waiting for Corehelper to finish....
Livecore: generating coredump of 1266
[New LWP 1377]
[New LWP 1378]
[New LWP 1379]
[New LWP 1380]
[New LWP 1382]
[New LWP 1383]
[New LWP 1384]
[New LWP 1385]
[New LWP 1386]
[New LWP 1387]
[New LWP 1388]
[New LWP 1389]
[New LWP 1390]
[New LWP 1391]
[New LWP 1392]
[New LWP 1393]
[New LWP 1394]
0x000000fff79a474c in pthread_cond_timedwait () from /lib64/libpthread.so.0
warning: target file /proc/1266/cmdline contained unexpected null characters
