object-groups in ACL for vty access-class in

[Steve Maggitti]

Hello all,

When I use an object-group in the ACL applied to the vty interface, I cannot connect to vty.  If I use essentially the same ACL without the object-group, access works as expected.  I found a 2009 comment on a forum saying object groups do not work in ACLs used for access-groups.  Is that still the case or am I just missing something?

object-group network admin

 172.16.0.0 255.255.0.0

ip access-list ext remoteadmin

 permit ip object-group admin any

line vty 0 4

 access-class remoteadmin in vrf-also

Thanks!

Steve

[benweber]

Anyone ever see this?  I'm having the exact same problem.  I want to use object groups for internal documentation but it won't work.  If I write the same ACL referencing the same subnets my object groups reference it works fine . . .

[piccallo]

This problem occured also for me. 

I solved it without using "access-class" in "line vty 0 4" - i made restriction to ssh through policy-map and assined it to zone-pair in ZBW:

object-group network SSH_NGROUP 
host x.x.x.x
host y.y.y.y
!

ip access-list extended SSH_OUSIDE
permit ip object-group SSH_NGROUP any

!

class-map type inspect match-all SSH_ACL_CMAP
match protocol ssh
match access-group name SSH_OUSIDE

!

class-map type inspect match-any UNTRUST_SELF_CMAP
match class-map SSH_ACL_CMAP

!

policy-map type inspect UNTRUST_SELF_POLICY
class type inspect UNTRUST_SELF_CMAP
inspect
class class-default
drop

!

zone-pair security UNTRUST-SELF source UNTRUST destination self
service-policy type inspect UNTRUST_SELF_POLICY

[Florian Stroemmer]

There is an open bug/enhancement dealing with this topic I ran into on a Cat9300 running v17.3.5

https://bst.cisco.com/bugsearch/bug/CSCuq64938

Regards

Florian