Using an object group in a reflexive ACL

[Josh Mil]

I'm trying to configure some access rules on a 3560CX switch.

This works without using an object group:

ip access-list extended test1
  permit tcp any any 80 reflect reflexive_acl

This works without using a reflexive ACL:

object-group service www_ports
  tcp 80
  tcp 443

ip access-list extended test2
  permit object-group www_ports any any

But this is not accepted in the console window:

object-group service www_ports
  tcp 80
  tcp 443

ip access-list extended test3
  permit object-group www_ports any any reflect reflexive_acl

After the destination address, there is no more option for reflect keyword

SWITCH(config-ext-nacl)# permit object-group www_ports any any ?
  log        Log matches against this entry
  log-input  Log matches against this entry, including input interface
  <cr>

I'm wondering whether this is not supported. Thank you.

[Jens Albrecht · Accepted solution]

Hello @Josh Mil,

you need to distinguish between service object-groups and network object-groups.

It is possible to use network object-groups in reflexive ACLs but you cannot use service object-groups.

BTW, the same limitation applies to IPv6 as well.
Network object-groups can be used on IPv6 reflexive ACLs but service object-groups cannot.

HTH!

[Josh Mil]

Thank you.

If service object group is not supported in reflexive ACLs, is there another way to simplify the code and reduce maintenance work if a group of ports (services) needs to be referenced in multiple reflexive ACLs?

[Jens Albrecht]

The only way that comes into mind is the use of scripting with Ninja2 templates to create your reflexive ACLs.

Depending on the number of ACLs and devices this could significantly speed up deployment and maintenance.

HTH!

[balaji.bandi]

what is version code, as per documentation it does not support :

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960cx_3650cx/software/release/15-2_7_e/configuration_guide/b_1527e_consolidated_3560cx_2960cx_cg/configuring_ipv4_acls.html?bookSearch=true

[MHM Cisco World]

object-group service MY-TCP-PORTS tcp
port-object eq 80
port-object eq 443

!!

ip access-list extended OUTBOUND-FILTER
remark Permit outbound traffic to specific TCP ports
evaluate TCP-REFLEX

permit tcp any any object-group MY-TCP-PORTS reflect TCP-REFLEX timeout 300
deny ip any any log

Try above

MHM

[Josh Mil]

I tried this initially, but after "any any" there is no option to specify object-group.

[MHM Cisco World]

Excuse me why you need object service if you have only two tcp ports?

Use reflexive without object service. 

And even why you use reflexive, use establish keyword which is more light than reflexive

MHM

[Josh Mil]

Thank you. But establish keyword has some limitations:

1. It works on TCP traffic only. I also need to filter UDP and ICMP.

2. It checks ACK or RST bit, bit doesn't really verify the packet belongs to an established session. An attacker can send a fake packet with ACK bit set, pretending to be the other party of the session.

[MHM Cisco World]

Point 1 Yes 

Point 2 this SW not FW so we have limit in policy to protect it from attack,

Even if hacker send tcp ACK bit the SW reject it, since it don't have any idea about this tcp session

MHM

[Josh Mil]

Thank you.

Regarding point 2, I always have an impression that inter-vlan routing within a switch is faster than using a firewall. Hence the reason of introducing layer 3 switches into networking. However, if we have to bear with such limitations, then what's the point of using a layer 3 switch?

[MHM Cisco World]

can we postponed this discussion to later tonight I have something to do 
thanks 

MHM 

[MHM Cisco World]

[Josh Mil]

Thank you. Apart from this scenario, there are also occasions that we need to allow conditional access between VLANs, as opposed to completely isolating them. For example, Hosts from finance department VLAN need to access a NAS in the marketing department VLAN, but we don't want the NAS initiate sessions to the finance department VLAN. Do we have to route through a router? What's a realistic scenario to use layer 3 switches? If it's just isolating VLANs, why don't we just use layer 2 switches?

[MHM Cisco World]

What's a realistic scenario to use layer 3 switches? If it's just isolating VLANs, why don't we just use layer 2 switches? <<- can you more elaborate 

MHM