cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

1830
Views
10
Helpful
2
Replies
Felibar
Beginner

Is it Possible to Make Multiple Access Rules Under One Entry

Apologies if the title doesn't make sense or this is a simple question; I am pretty new to working with Firewall Rules and all.  In this case, i am using a Cisco 5516-X and in ASDM v 7.13(1).

What I want to know/do in this case is: I have a department that at certain points of the year has to have a large block of Outbound rules created/enabled.  These are all Outbound rules, mostly TCP and UDP, to about 10 distinct IP addresses across 15+ different ports.  I was wanting to know if there was a way to create like one Object/Entry that would contain all those rules so that I could go in during their Off-Season and disable those Rules without having to go back and track down 20+ unique Access Rule Entries because some of those rules my Boss does not want open year round. 

 

-Or-

 

If the above isn't possible, is it possible to create an Access Rule that has multiple IP addresses but they all need the same ports and protocol? That would let me pare down the entries some if I could comma-separate them or some other obvious method of doing so. 

 

[Example of Requested Rule with Made Up Addresses/Ports:]

Destination IPPortsProtocolDirection

69.62.122.1/32

128.11.107.0/24

80, 443 ,5223, 7731, 60000-60200TCPOutbound

 

Otherwise, I suppose I will have to make an Access Rule per address, per port, per protocol and make sure to document them extremely well or work out a way to set up a Schedule or Expiry date!

 

Again, sorry for such basic questions.  I am trying to learn on the fly here and wasn't having much luck searching since I've not mastered all the terminology yet.

 

Thanks in advance for your time and I look forward to any questions/responses! In the meantime, I'll keep reading up and hope I can figure this out in time!

1 ACCEPTED SOLUTION

Accepted Solutions
Rob Ingram
VIP Mentor

Hi,

You can define one ACE (ACL rule) and reference object groups. The object groups would contain the source network(s) and another object for the service ports. Here is an example to configure via the CLI:-

 

https://www.networkstraining.com/using-object-groups-with-cisco-asa/

 

I don't have an example to configure in ASDM, but essentially when defining the rule, just select multiple objects.

 

HTH

View solution in original post

2 REPLIES 2
Rob Ingram
VIP Mentor

Hi,

You can define one ACE (ACL rule) and reference object groups. The object groups would contain the source network(s) and another object for the service ports. Here is an example to configure via the CLI:-

 

https://www.networkstraining.com/using-object-groups-with-cisco-asa/

 

I don't have an example to configure in ASDM, but essentially when defining the rule, just select multiple objects.

 

HTH

View solution in original post

Excellent, thank you for the quick reply and the link as well!

Content for Community-Ad