using object-group

[mindorewala]

I would like to block all ports by default on outside interface on firewall.

Only selected ports should be open.

Pls. find the attached firewall config.

If i remove the below line from config (page 1: second last line)

access-list intf2_access_in permit ip any any

(page 2: 3rd line from top)

access-list outside_access_in permit ip any any

traffic doesn't flow.

What could be wrong and how can we resolve and apply object group for port blocking.

[mehrdad]

check this out :

access-list intf2_access_in permit tcp any any eq object-group allow

Regards,

Mehrdad Arshad Rad

[mindorewala]

any effect on the NAT, if i apply this statement!!!!

Thanx a million

Regards,

Mustafa Indorewala

[mindorewala]

I checked this command, but it doesn't accept.

Regards,

Mustafa

[mehrdad]

use it without 'eq' operator, like below :

access-list intf2_access_in permit tcp any any object-group allow