How do I add many subnets to asa?

[Rick Morgan]

My ASA

Cisco Adaptive Security Appliance Software Version 8.0(5)

Device Manager Version 6.2(5)53

Does anyone know how to add many IP subnets to an asa?

As an example lets say I want to create a group "country block list", and I have a block of subnets;

2.60.0.0/14

2.92.0.0/14

31.3.16.0/21

31.7.224.0/20

31.8.0.0/16

31.10.0.0/21

31.10.8.0/21

How do I add them as one group? Can this be done?

Thanks,

Rick

[Dan-Ciprian Cicioiu]

You can try using object-groups :

object-group network country

network-object 2.60.0.0 255.252.0.0

network-object 2.92.0.0 255.252.0.0

.....
and so on

I hope i understood well your question

Dan

[varrao]

Rick,

On the ASA you can create object-group and under a single object-group include all the different subnets, so a single object-group would represent the the complete subnets that you have. Just for your reference, have a look at the command reference:

http://www.cisco.com/en/US/partner/docs/security/asa/asa80/command/reference/no.html#wp1750094

Sample config:

hostname(config)# object-group network sjc_ftp_servers

hostname(config-network)# network-object host sjc.ftp.servers 

hostname(config-network)# network-object host 172.23.56.195 

hostname(config-network)# network-object 193.1.1.0 255.255.255.224 

hostname(config-network)# group-object sjc_eng_ftp_servers 

hostname(config-network)# exit


Hope this helps.

Thanks,
Varun

[Rick Morgan]

Ok I created a network group called blocked list. How do I add an ACL to this group to block all incomming WAN traffic to this group.

Thanks,

Rick

[Dan-Ciprian Cicioiu]

I dont think that the name of your object group could be "blocked list" - with space in the name.

To make use of the object-group in the access-list you must use "object-group blocked" ( if the name of the object-group is blocked) instead of using network and netmask pairs.

Dan

[varrao]

Here is a sample configuration that might ease out things for you:

access-list 104 permit ip host object-group A object-group B 

where A & B are the names of your object-group

Hope this helps.

Thanks,
Varun

[Dan-Ciprian Cicioiu]

varrao wrote:
access-list 104 permit ip host object-group A object-group B 

Thanks,
Varun

Hello Varun ,

I think that your command will not work.

Dan

[varrao]

ooopss.. sory for the typo