Knowledge Nugget ASA Object Grouping

1. Knowledge NuggetASA Object Grouping Bogdan Doinea Assoc. Technical Manager CEE&RCIS bdoinea@cisco.com Cisco Networking Academy

2. ACL Scalability Issues What is Object grouping? Types of Object grouping ASA Object Grouping

3. ACL Scalability Issues • A firewall will naturally have many ACLs • The only way to permit traffic from a lower security level to a higher one is through and ACL • Problem: ACLs become repetitive and very big asa1(config)# access-list ACLOUT permit tcp any host 192.168.1.8 eq http asa1(config)# access-list ACLOUT permit tcp any host 192.168.1.8 eq https asa1(config)# access-list ACLOUT permit tcp any host 192.168.1.8 eq ftp asa1(config)# access-list ACLOUT permit tcp any host 192.168.1.9 eq http asa1(config)# access-list ACLOUT permit tcp any host 192.168.1.9 eq https asa1(config)# access-list ACLOUT permit tcp any host 192.168.1.9 eq ftp asa1(config)# access-list ACLOUT permit tcp any host 192.168.1.10 eq http asa1(config)# access-list ACLOUT permit tcp any host 192.168.1.10 eq https asa1(config)# access-list ACLOUT permit tcp any host 192.168.1.10 eq ftp

4. Object grouping • Idea: recognizing patters in ACLs and grouping those ACL entries within an object • Objective: making ACLs shorter and easier to read • Objects can be created around: • Protocol (TCP, UDP) • Networks (your inside networks) • Services (the services in the DMZ) • ICMP ( echo_request+echo_reply = ping) • After creating object groups, they can be directly tied to ACLs asa1(config)# access-list OUTSIDE permit tcp any object-group DMZ_SERVERS object-group DMZ_SERVICES

5. Steps in configuring Object Grouping Step 1: Use the object-group command to enter the appropriate subcommand mode for the type of group you want to configure. Step 2: In subcommand mode, define the members of the object group. Step 3: (Optional) Use the description subcommand to describe the object group. Step 4: Use the exit or quit command to return to configuration mode. Step 5: (Optional) Use the show run object-group command to verify that the object group has been configured successfully. Step 6: Apply the object group to the access-list command. Step 7: (Optional) Use the show access-list command to display the expanded ACL entries. 

6. Configuring Network Object Groups 10.0.0.0 /24 192.168.2.0 Internet 10.0.1.0/24 • object-group network obj_grp_id • Assigns a name to the group and enables the network subcommand mode • network-object host host_addr | host_name • Adds a host to the network object group asa1(config)# object-group network INSIDE asa1(config-network)# network-object host 10.0.0.1 asa1(config-network)# network-object host 10.0.0.2

7. Configuring Service Object Groups • HOST_SERVICES • HTTP • HTTPS • FTP 192.168.2.0 10.0.0.0 /24 Internet 10.0.1.0/24 • object-group service obj_grp_id {tcp | udp | tcp-udp} • Assigns a name to a service group and enables the service subcommand mode • port-object {eq service | range begin_service end_service} • Adds a port object to a service object group asa1(config)# object-group service HOST_SERVICES tcp asa1(config-service)# port-object eq http asa1(config-service)# port-object eq https asa1(config-service)# port-object eq ftp asa1(config-service)# port-object range 137 139

8. Configuring ICMP-Type Object Groups 192.168.2.0 Internet 10.0.0.0 /24 • Ping • Echo • Echo-reply 10.0.1.0/24 • object-group icmp-type obj_grp_id • Assigns a name to an ICMP-type group and enables the ICMP-type subcommand mode • icmp-object icmp-type • Adds an ICMP message type to an ICMP-type object group asa1(config)# object-group icmp-type PING asa1(config-icmp)# icmp-object echo asa1(config-icmp)# icmp-object echo-reply

9. Configuring Protocol Object Groups • INSIDE_PROTOCOLS • TCP • UDP 192.168.2.0 Internet 10.0.0.0 /24 10.0.1.0/24 • object-group protocol obj_grp_id • Assigns a name to a protocol group and enables the protocol subcommand mode • protocol-object protocol • Adds a protocol to a protocol object group asa1(config)# object-group protocol INSIDE_PROTOCOLS asa1(config-protocol)#protocol-object tcp asa1(config-protocol)#protocol-object udp

10. Applying the Object to the ACL 192.168.1.0 Internet 10.0.0.0 /24 10.0.1.0/24 • access-list id [line line-number] [extended] {deny | permit}{protocol | object-group protocol_obj_grp_id}{host sip | sipsmask | interface ifc_name | object-group network_obj_grp_id | any}[operatorport [port]| object-group service_obj_grp_id]{host dip | dipdmask | interface ifc_name | object-group network_obj_grp_id | any}[operatorport [port] | object-group service_obj_grp_id ][log [disable] | [level] |[default] | [interval secs]][inactive | time-range time_range_name] asa1(config)# access-list INSIDE permit tcp object-group INSIDE_ENG any object-group HOST_SERVICES • Permits outbound engineering HTTP, HTTPS, and FTP traffic

11. Display Object Groups • show running-config object-group [protocol | service | network | icmp-type | id obj_grp_id] • Displays object groups in the configuration asa1# show run object-group object-group network INSIDE network-object host 10.0.0.1 network-object host 10.0.0.2   object-group service HOST_SERVICES tcp port-object eq www port-object eq https port-object eq ftp port-object range 137 netbios-ssn object-group icmp-type PING icmp-object echo icmp-object echo-reply

12. Useful links • Join the Global Instructor Community • http://community.netacad.net • Check out more knowledge nuggets • http://lms.netacad.net/course/view.php?id=3101 • ASA Essentials Series • The less known world of IPv6 – Tunneling, Autoconfigure, Routing • DHCP Series • PPPoE – combining PPP and Ethernet • Netacad Maintenance • Advanced VLAN Troubleshooting