Help with object groups and ACL

[Andy White]

Hello,

I'm trying to use object groups as I can see this access list is going to grow so it will be easier to add to the groups, but I can't add the acl.  I've create the network and service groups.

access-list 123 permit tcp host 10.10.1.66 eq 601 10.15.10.0 0.0.0.255

object-group network servers1

host 216.58.233.70

host 212.84.71.166

!

object-group service servers1_Ports

tcp eq www

tcp eq 443

ip access-list extended 123

131 permit tcp object-group servers1 object-group servers1_Ports 10.15.10.0 0.0.0.255

Error

131 permit tcp object-group servers1 object-group servers1_Ports 10.15.10.0

                                                             ^ 0.0.0.255

What am I doing wrong?

Thanks

[blau grana]

Hello Andy,

Try to first specify service object-group, than network object-group ->

ip access-list extended 123

131 permit tcp object-group servers1_Ports object-group servers1 10.15.10.0 0.0.0.255

(config-ext-nacl)#permit ?

  object-group  Service object group

(config-ext-nacl)#permit object-group TEST ?

  object-group  Source network object group

Best Regards

Please rate all helpful posts and close solved questions

[Andy White]

Hi,

It seems to want the network group first:

#131 permit tcp object-group ?

  WORD  Source network object group name

[Andy White]

Ah I see:

131 permit ?

object-group  Service object group

[blau grana]

I see where is problem.

This is your original configuration.

ip access-list extended 123

131 permit tcp object-group servers1 object-group servers1_Ports 10.15.10.0 0.0.0.255

But if you specify protocol "131 permit tcp" you can not use service object-group. So valid configuration will be like this:

ip access-list extended 123

131 permit object-group servers1_Ports object-group servers1 10.15.10.0 0.0.0.255

- without TCP and service object-group first

OR

ip access-list extended 123

131 permit tcp object-group servers1 eq 80 443 10.15.10.0 0.0.0.255

- with TCP, without service object-group and with ports explicitely configured

Best Regards

Please rate all helpful posts and close solved questions