Cisco :: Named Objects Or Object Groups In ASR 1000s?

Mar 5, 2012

Any way of doing named objects or object groups for ACLs on the ASRs? (1000 series in this case.) I'm setting up an ASR with a zone-based firewall and writing out all the addresses, ports and protocols for the ACLs associated with the various zones is creating huge, unwieldy ACLs in the config.

View 11 Replies


ADVERTISEMENT

Cisco Firewall :: Recreate Objects In Groups After Migration To 8.3?

Feb 22, 2012

when I migrated the ASA config from 8.2 to 8.3, in all groups the group members has been replaced by the IP address object. However, the "name" for this object has been migrated, but there is the "object network name" configuration missing.
 
What I can do now is that I can open the new created object in the ASDM, search for the object with this IP address and then enter the object name I had before. When I apply the config, ASDM then creates the object and replaces all affected objects in all groups, by replacing the object group memeber "network-object host hostname" with "network-object object hostname".
 
Do you know if there exists an automated way, which checks all the groups for members "network-object host", creates the "object network" and replaces the "network-object hosts" with "network-object object" within the group? As long we have a lot of groups which contains partially > 50 members?

View 2 Replies View Related

Cisco Firewall :: ASA 8.4 DNS Names In Object-groups

Jun 8, 2011

Is it possible somehow to define externally administred DNS namese in ASA 8.4 in within object groups?i know that we can use name XXX, but some idea popped up using this kind of configuration.

View 3 Replies View Related

Cisco Firewall :: ASA 5510 Object Groups / Creating New ACL

Jul 20, 2011

I have an ASA5510 where I have defined object-groups and then associated them with a specific ACL.  Our ISP is pulling their point of presence from where I live and I am force to move to a new ISP.  I am in the process of setting up another interface for the ASA5510 to connect to the new ISP.
 
My questions is can I create a new ACL lets call it new_access_in and use it with the same object groups that I have already defined?  I know that I can only have one ACL bound to an interface, and will bind this new ACL to the new interface I am setting up, but I wasn't sure if I could use the same object groups and connect them to a different ACL.  I really don't want to have to create new object groups if I don't have to.

View 2 Replies View Related

Cisco Firewall :: ASA 5510 Object-Groups Not Working

May 9, 2012

I have an ASA 5510 and have just started using object-groups which are super handy in theory, but not working in reality. I have a service object-group with a mix of tcp, icmp, and udp ports. Let's call it Sample_Port_Group. I'm trying to apply it to my dmz_access_in ACL. Here's the line giving me problems:
 
access-list dmz_access_in extended permit object-group Sample_Port_Group 192.168.1.1 any
 
The asa throws up an error between 192.168.1.1 and any. When I put up a ? after Sample_Port_Group, it gives me the option of putting in an IP address, any, etc. When I put in a ? after 192.168.1.1, it only gives me the option of putting in an IP address.URL

Those posts gave me the impression my line was possible, especially the "access-list outsideacl extended permit object-group myaclog interface inside any" line, which is at the end of the 2nd article linked.

View 2 Replies View Related

Cisco Switching/Routing :: Object-groups In Access-lists On 3750X?

May 29, 2013

I have started to use ip extended access-lists on several 3750X-switches to filter inbound and outbond traffic on the VLANs. But it seems that the use of object-groups is not supported, is this correct? Is it really no way to group different ip-addresses into groups and then use these groups in the access-lists?
 
I am running sw version 15.0(1)SE2.

View 1 Replies View Related

Cisco Firewall :: ASDM 5.0.7 Creates Duplicate Network Object Groups

Aug 5, 2011

We are facing the problem in ASDM 5.x creates duplicate network object groups in the configuration when PIX with software 7.0.7 is used.
Audit report its showing below commands :
 
asdm group SALES_ref dmz2 reference SALES object-group network SALES_ref network-object 172.20.7.8 network-object 172.20.10.3 network-object 172.20.11.2
 
no access-list dmz2_access_in extended permit tcp object-group Network_10.10.1.0 object-group SALES object-group SALES_Ports access-list dmz2_access_in line 200 extended permit tcp object-group Network_10.10.1.0 object-group SALES_ref object-group SALES_Ports
 
i was created SALES object group 2 month back after that ASDM Automatically created the duplicate object with SALES_ref name and changed the old ACL.

View 3 Replies View Related

Cisco Firewall :: Using Object-Groups For Easy Maintain ASA 5520 Configurations

Sep 19, 2011

After reading the post titled "ASA 5520 nat access-list query for internet access" I realized the object-group command could and should be used to make a more efficient and cleaner configuration. My current environment is very small and straight forward consisting of one FTP server in the DMZ. Though the guide: [URL] is straight forward, my inexperience hinders me from seeing how to use the commands effectively. A summary of the configuration is at the bottom of this post
 
Question: How can I clean up my current configuration? I have two references to the same server, dmz-rdp and dmz-ftp, created for port forwarding ports 3389 and ftp through the outside interface. I can combine them into one object statement, right? for each port I want to forward through the outside interface?
 
object network dmz-rdp
host 10.10.10.4
nat (DMZ,outside) static interface service tcp 3389 3389

[Code]....

View 1 Replies View Related

Cisco Firewall :: 5520 - Object-group With Network-object Containing IP Address Range

Apr 7, 2013

Does the ASA treat an object-group with a network-object containing a range of IP addresses as a netmask? For example, I can apply this configuration without the ASA throwing any errors though the configuration calls for a 'net mask':
 
object-group network test
network-object 192.168.0.0 192.168.63.255
?
network-object-group mode commands/options:
A.B.C.D  Enter an IPv4 network mask
sh run ob id test
object-group network test
network-object 192.168.0.0 192.168.63.255
 
I found that in the documentation it requires a netmask as oppose to a range. Is this a bug in the code? I am running code version 8.0(5)23 on a 5520. If this is not a bug how does the ASA treat this type of configuration when applied to an access list? When I ran a quick packet trace and denied access from that range it looks like the ASA doesn't read that configuration properly.

View 5 Replies View Related

Cisco :: LMS 4.1 No User Defined Groups Shown In Fault Notification Groups?

Dec 12, 2011

I created some User Defined Groups in LMS 4.1, now I want to apply certain fault notification groups to Event Sets.
   
Unfortunately the Groups I configured are not in the Group Selector of the Fault Notification Group: Admin > Network > Notification and Action Settings > Fault Notification Group

View 3 Replies View Related

Cisco WAN :: ASR 1001- How Interfaces Are Named

Sep 3, 2012

I just need to start building the configuration of an ASR 1001 but I do not know how gigabitethernet interfaces are named on these routers? Are Gi0/0/X or Gi0/X ??

View 1 Replies View Related

Cisco WAN :: 7200 VXR - Named Extended Access List

Oct 10, 2012

I've got a 7200 vxr that I'm trying to create a named extended access-list in.
 
I got to configure it if I go into ip after that the only commands available for access-list are log-update, logging, and re sequence.
 
so if I go back to the main config menu access-list is an available command
 
but then from the main config menu, if I type: access-list extended eth0_in it says invalid input detected at the carrot marker which is under the first character of the work extended.
 
also, at the main config menu, if I type: ip access-list extended eth0_in it again give me the invalid input detected at the word extended.
 
I don't understand what I am missing to get this to work.

View 9 Replies View Related

Cisco WAN :: 1841 - Named Versus Numbered ACLs

Dec 27, 2010

In my test lab I am playing with the Numbered ACL's and Named ACL's. Both configurations are working BUT , I am sure I do something wrong in the Named ACL's version. When I reboot or reload the CISCO 1841 ROUTER , I do not have INTERNET anymore , I still have access by TELNET or SSH , but no external communication anymore. The only way to start the communication again , is by adding :

PERMIT IP ANY ANY . This will of course work , but the funny thing is that when I do a : NO PERMIT IP ANY ANY It still works !!!
 
I have learned by this to always shut down and restart my ROUTER or SWITCH to see if everything still work . Here bellow some parts of the working Numbered ACL's version :
 
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh port 8096 rotary 1
ip ssh version 2
[ code] ....

View 4 Replies View Related

Windows Can't Find Computer Or Named Device

Oct 12, 2012

I get 2 troubleshoot messages printer cannot be contaacyed over network and windows can't find a computer or device named....

View 1 Replies View Related

Cisco Firewall :: ASA 5510 Version 8.2(4)2 Can't Remove ACL Named Extended

Feb 13, 2012

I have an access-list that was named "extended" (without quotation marks) and the ASA will not let me remove it.
 
I have tried everything I know to try and get it out, but I cannot remove a single line.
 
ASA(config)# no access-list extended line 1 extended permit ip host 10.1.1.1 host 192.168.1.1ERROR:<1> not a valid permission
 
ASA(config)# no access-list extended line 1 permit ip host 10.1.1.1 host 192.168.1.1ERROR:<1> not a valid permission

View 1 Replies View Related

Cisco Wireless :: 5508 Assign Single Ssid To Multiple Interface Groups By Assigning Ssid To Multiple AP Groups

Aug 26, 2012

Is it possible to assign a single ssid to multiple interface groups by assigning the ssid to multiple AP groups? 
 
I have buildings geographically dispersed that are configured with multiple vlans in interface groups so that I can maintain an addressing scheme of dhcp assigned addresses per building.  Each building is also further grouped as AP groups.  I'd like to know if by assigning the same wlan ssid to each of the AP groups, will I maintain addressing integrity for each building?  I'm thinking it will work.
 
Do the buildings have to be outside AP range of each other to avoid problems?

5508 controller
7.2.110.0  code
6 buildings
6 interface groups
1 ssid

View 4 Replies View Related

Linksys Wireless Router :: E1000 Is Showing Different Named Wifi Network?

Jun 29, 2012

I have a strange problem with my Linksys E1000. When I try to connect wireless, there is a network with an excellent signal, but it has the name "CiscoI1593" and it asks for a password which I don't know. My original network does not appear for some reason when I try to connect wirelessly. I do see my original network name when I use an ethernet cable through the E1000.
 
It's not possible, where I live, for this "CiscoI1593" network to belong to someone else, it just seemed like it renamed my network to this and also wants some different password. 
 
I think this may be due to something I did. My internet occasionally cuts out and it's usually something wrong with the modem or router, so I typically unplug and press the reset button on both until it begins to work again. This is the first time i've had this problem though, and I have unplugged and pressed the reset button on my router many times.
 
There is also a button in the middle of the front of the router that looks like a refresh symbol, but I don't really know what it is, pushing it doesn't seem to do anything but make a solidly-on light become blinky.

View 6 Replies View Related

Cisco Application :: MIB Objects For CSS 11503?

Jun 9, 2009

i need the MIB object names for monitoring the processor and Memory Utilization of CSS 11503 with software version 7.50 Where can I find it?

View 5 Replies View Related

Cisco Firewall :: How Many Objects Can ASA 8.3(2) Support

Jun 22, 2011

We are currently running 8.3(2) and I'm just wondering how many network/host objects the device can support? and how big can an access-l get?

View 1 Replies View Related

Cisco WAN :: 2821 / IP SLA Tracking Objects Dropping?

Mar 24, 2013

I use tracking objects aroung the organization where I work to monitor WAN and VPN connections and add/remove routes based on the state of the object.  I'm having 2 locations that are constanty going up and down and I've been troubleshooting and monitoring for the last few weeks without finding anything.  I've been incrementing the timeout for the SLA and it seems like this is working a little (less overall drops) but the drops still occur.  Our ISP reports no issues and we see no issues internally on the circuits.  Just out of curiosity could this be some kind of IOS bug or hardware malfunction?  The router logs are full of these:
 
Mar 21 16:18:33: %TRACKING-5-STATE: 2 ip sla 2 reachability Up->Down
Mar 21 16:18:38: %TRACKING-5-STATE: 2 ip sla 2 reachability Down->Up
Mar 21 17:24:14: %TRACKING-5-STATE: 2 ip sla 2 reachability Up->Down
Mar 21 17:24:19: %TRACKING-5-STATE: 2 ip sla 2 reachability Down->Up

[code]....
 
The IOS version of the router I took these from is 151-4.M6 advanced IP services and it's a 2821 router.

View 5 Replies View Related

Cisco Firewall :: ASA 8.3 - Migration Changes Hosts To Objects?

Sep 24, 2012

I'm testing upgrading an ASA from 8.2.5 to 8.4.4.  During the the upgrade, it change all of my ACL host entries to objects.  But I noticed that the keyword "host" is still a valid option when creating an ACL.
 
I'm trying to understand why this change is made during the migration.

View 3 Replies View Related

Cisco WAN :: 800 Network Objects To Allow Management User IP

Aug 27, 2012

I'm trying to add an extended ACL (120) to an 800 series router (887) using Network Objects to allow the management user IP range full access to IP services and restricted access to email only for standard user IP range. However as soon as I apply the ACL to the outbound of my Vlan no matter what is in the ACL my PC looses internet connectivity. I've tried adding an explict allow for my IP address and still no access so I'm thinking possible a NAT issue, please have a look at my attached config and let me know what you think. Would I be better trying to control data flow with ZBF? I want to restrict standard users to email access only during the work day with web access and IM access after hours along with blocking all P2P programs for standard users at any time. Management group will have unrestricted access to all IP protocols. My original plan was to use time based ACL's!

View 9 Replies View Related

Cisco Firewall :: ASA5505 NAT For Group Of Objects

Oct 4, 2010

My ASA5505 has an external address of x.x.x.13. We have got another 2 spare ip addresses: x.x.x.10 and x.x.x.11.We also have 2 internal hosts, which we need to provide with internet access using NAT. y.y.y.146 and y.y.y.70.
 
We recently updated our ASA to software version 8.3(1). I was thinking that I could do it using network objects and groups, but didn't understand quite good how this should be done.
 
The goal is to set up ASA in the way, that if either of the abovementioned 2 hosts will connect to the internet, it needs take one of 2 external addresses. All other hosts should use PAT through x.x.x.13.

View 21 Replies View Related

Cisco Firewall :: ASA 5520 Adding Network Objects Via CLI

Nov 3, 2011

I'm working with ASA 5520s. how to add network objects via CLI. I know I could easily do it using ASDM, but I like to learn the hardway first. How do I add the subnet mask for a network object when creating via CLI? [code] That sets up the hosts with IP addresses, but how do I add the subnet mask?

View 2 Replies View Related

Cisco Firewall :: ASA 5520 - Creating Host Objects Via CLI

Nov 3, 2011

I am trying to create host objects that I'll then add to network-object groups for use in ACL/ACEs.When I try to create a host I am having trouble adding the IP address.I then get an error saying the host name must start and end with letters or numbers and only contain letters or numbers. What do I need to do to create hosts from CLI?

View 2 Replies View Related

Cisco Firewall :: Can't Create Network Objects On ASA 5505

May 17, 2011

I have a customer an exisiting 5505 which connects to multiple sites for a site-to-site VPN.  This firewall was not installed by myself originally I have just been asked to take a look now.The situation is that we now need to edit one of the existing site-to-site VPNs to include the remote sites expanded network.  I have tried doing this through the ASDM and have found that I cannot add new network objects.  I have tried creating a new network object group and then added the new networks from there but I am completely unable to add the new objects.I believe a picture tells a thousand words in this case so I have attached some images which show the problem.  I have also tried going through the VPN wizard, this also does not allow me to add new network objects. 

View 2 Replies View Related

Cisco Infrastructure :: Export Objects (net And Security) From ASA 5500 Firewall To CSV File?

Feb 14, 2012

how to export objects (net and security) from an ASA 5500 firewall to a .csv file?

View 1 Replies View Related

Cisco Security :: Why Does ACS 5.1 Domain Account Must Have Permission To Create / Delete Objects

Mar 23, 2011

Any detailed knowledge about Cisco ACS 5.1  and Windows AD interaction? I wonder why does Cisco ACS domain account must have permission to create/delete domain objects. This fact does really surprided me, because to my mind Cisco ACS only reads domain structure, and does not make any changes.

View 3 Replies View Related

Cisco :: ASA 8.3 Object Vs Names

Jan 6, 2012

Just planning my move to 8.4(2) and I'm looking for some input. In the past, I have a text file with name commands for every host on my network that I know about. I would then deploy this list to all ASAs so that I could create ACLs on any firewall using a name, which would correlate to the same IP on any firewall.Now, the names from the name command no longer work as a host entry in ACLs, therefore I'm required to switch all of my active name command entries over to objects.My question is, have any of you found an easy way to change all name commands to objects? Since the name command doesn't specify the mask of the entry, I think this may not be possible without manually updating thousands of records. I know that once I migrate, there will be some objects auto-created, but those will only be host and or networks which have NATs associated with them.

View 7 Replies View Related

Cisco :: LMS 3.2 / Device Not In DCR But Shows Up In Object Finder?

Oct 26, 2011

Environment: Solaris 10(Sparc)
LMS 3.2
RME 4.3.1
CS 3.3.0
CM 5.2
 
I need to delete a device from CiscoWorks but I cannot find it in the Common Services->Device Management search. I can find it by IP address using the Network->Object Finder . It has an IP address, hostname, display name, and "managed by" information in the search results. Supposedly its managed by:

RME
IPM
DFM(listed twice)

However, when I click on the device link , it has almost no tools available (limited to ping) and no device information. I'm hard pressed on how to delete the item withouth having it in Common Services so that I can select it and then click on "delete" . how I can purge this device?

View 2 Replies View Related

Cisco Firewall :: Object To Twice NAT Configuration ASA5505 8.4?

Dec 18, 2011

We have an ASA5505 that we need to enable hairpinning on.... In the old firmware versions, we used to be able to configure a public to private static mapping along with hairpinning by using
 
static (inside,outside) outside_ip inside_ip netmask 255.255.255.255
static (inside,inside) outside_ip inside_ip netmask 255.255.255.255
 
In 8.4, if I use object nat, the hairpin functionality works perfectly,
 
object network obj-insideip
  nat (inside,inside) static publicip
 
however, since object nat only allows a single nat statement, I was attempting to use a twice nat to enable the hairpin functionality, but have been unsuccessful in coming up with the right combination of parameters for the functionality.
 
nat (inside,inside) source static private_object public_object destination static public_object private_object
 
allows hairpinning to successully work from the same machine.  Meaning on any given host, I can ping itself using the private or public ip, but I can't get the right combination for hairpinning from any private host to another private host via the public ip.  Other combinations have yielded icmp responses, however, they specify the private IP as the source of the reply instead of the public ip.

View 1 Replies View Related

Cisco Firewall :: ASA 8.4 Network Object NAT Ordering

Aug 19, 2012

There is something wrong with the ordering of our NAT-rules.We are running ASA Version 8.4(2)8 and the nat config is pasted below.
 
I want outgoing smtp-traffic to be translated to xxx.yyy.zzz.18, but instead it's translated to xxx.yyy.zzz.20 (the outside-interface address).The same goes for ftp-traffic, according to packettracer this is also translated to the xxx.yyy.zzz.20.
 
Ciscos manual states that static nat rules takes precedence over dynamic nat but that doesn't seem to work for us. [code]

View 7 Replies View Related

Cisco :: What Data Is Assigned To What Object On ASA5510

Jul 17, 2011

I'm trying to determine who's throttling our 'Outside' interface because it's being hogged.Is there an easy way to see what data is assigned to what object on our ASA5510

View 2 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved