Object-groups tcp and udp using different ports numbers.

[m-rosebury]

Does anyone know if it is possible to use Object-groups with tcp and udp in the same group but using different port numbers?

The service tcp-udp is useful for something like DNS where the tcp and udp ports are the same but not for other combinations such as syslog where different port numbers are used.

Using a nested group-object also fails if adding both tcp and udp group together in a tcp-udp higher level group. The error message is;

"Adding obj to object-group (syslogtcpudp) failed; obj and group type inconsistent"

Thanks

Matt

[gfullage]

For something like syslog you have to use two separate object groups and two separate access-list lines.

Within a TCP-UDP OG, you can specify both port numbers, (let's say 512 and 333), but you'll end up letting in TCP and UDP packets on port 512 and 333, which will work, but is not exactly what you want.

[m-rosebury]

Obviously it can be done with two object groups and two access-list entries but the question was, can it be done with one. I guess the answer is NO unless someone else knows better.