Hi I have:- ! object-group network WEB_SITES network-object object www.123.de network-object object www.123.com network-object object www.123.eu network-object object www.123.fr network-object object www.123.nl network-object object www.123.be ! sh run object-group service object-group service 80443 service-object tcp destination eq www service-object tcp destination eq https ! ! I want to allow any source to access  destinaton "WEB_SITES" on the pots in "80443" I tried, access-list OUTSIDE extended permit tcp any object-group WEB_SITES object-group 8044 3 and got "ERROR: specified object group <80443> has wrong type; expecting service type" BUT if query the syntax, it asks for? access-list OUTSIDE extended permit tcp any object-group WEB_SITES ?                 configure mode commands/options:   eq            Port equal to operator   gt            Port greater than operator   inactive      Keyword for disabling an ACL element   log           Keyword for enabling log option on this ACL element   lt            Port less than operator   neq           Port not equal to operator   object-group  Optional service object-group for destination port   range         Port range operator   time-range    Keyword for attaching time-range option to this ACL element   <cr> access-list OUTSIDE extended permit tcp any object-group WEB_SITES  object-group ? configure mode commands/options:   WORD  Service object-group name for destination port What am I doing wrong? Im sure you can allow destination to a group of ports!! It's late and my head hurts Im on:- sh ver Cisco Adaptive Security Appliance Software Version 8.4(2) Device Manager Version 6.4(9) Compiled on Wed 15-Jun-11 18:17 by builders System image file is "disk0:/asa842-k8.bin " Regards, ... View more

Hi, Appreciate there may not be a right or wrong answer here, as this varies from topology to topology, but I’m looking for some notes from the field guidance here from those that have much more deployment experience. I have a GSS and an ACE, and its the ACE that's primarily giving me something to think about, in terms of placement and what mode to adopt. The traffic flow will look loosely like this:- Client---Internet---Firewall---GSS---ACE---Servers Physically, it's like this. The RED line denotes a boundary, and pretty much anything North of that is not accessible to us, we simply have a L3 trunk between our switches and "their" switches (S3/S4) and talk using EIGRP. There are other servers in the top tier, some that also require load balancing, some that don’t. Typically, I want to load balance https requests from the internet, to one of the 3 servers in the top half. I’m not sure what mode to select, routed, one arm? What about placement of the ACE? At the moment, I’ve just configured 1/1 on it and made it part of the MGMT VLAN, it's SVI exists on the S1/S2 switches, so I’m open to change as it's still all in the lab. What  suggestions for easy deployment can you give me? ... View more