I'm having trouble on an outbound vlan access map. I'm trying to get it to allow packets from 192.168.20.20 tcp/445 but the only way I can do it is manually entering the "expanded" version of the command.
object-group service cifs
description smb/cifs ports
icmp echo
tcp eq 139
tcp eq 445
udp eq netbios-ns
udp eq netbios-dgm
icmp echo-reply
icmp traceroute
!
object-group network SERVER
host 192.168.20.20
!
When I reference those using:
...
permit object-group cifs any object-group SERVER any
...
sh ip access-list FOO expanded
...
6 permit icmp host 192.168.20.20 any echo log
7 permit tcp host 192.168.20.20 any eq 139 log
8 permit tcp host 192.168.20.20 any eq 445 log
9 permit udp host 192.168.20.20 any eq netbios-ns log
10 permit udp host 192.168.20.20 any eq netbios-dgm log
11 permit icmp host 192.168.20.20 any echo-reply log
12 permit icmp host 192.168.20.20 any traceroute log
Only focusing on 445...the above defines any packet from 192.168.20.20 from any tcp port to dst tcp 445)
What I need it to expand to is:
(any packet from 192.168.20.20 from tcp 445 to any dst host any dst port)
permit tcp host 192.168.20.20 eq 445 any log <-- manually entering this works
So, how can I use service and network object groups to achieve the (permit tcp host 192.168.20.20 eq 445 any log) format for all of the services in the service group?
I'm quite possibly just doing it wrong :)
EDIT
I might have found it.
I think by creating a new service group using "source" rather than "eq" it expands how I intended. I was hoping to use same object group for each way (IN/OUT) but whatever.
object-group service cifs-src
tcp source eq 445
tcp source eq 139
udp source eq netbios-ns
udp source eq netbios-dgm
!
