Cisco ASA 5508-X, Configuration Manual

Page: 16 / 428

2-4
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 2 Objects for Access Control
Configure Objects
hostname (config-protocol)# network-object host 10.2.2.4
hostname (config-protocol)# network-object host 10.2.2.78
hostname (config-protocol)# network-object host 10.2.2.34
Create network object groups for privileged users from various departments by entering the following
commands:
hostname (config)#
object-group network eng
hostname (config-network)# network-object host 10.1.1.5
hostname (config-network)# network-object host 10.1.1.9
hostname (config-network)#
network-object host 10.1.1.89
hostname (config)# object-group network hr
hostname (config-network)#
network-object host 10.1.2.8
hostname (config-network)# network-object host 10.1.2.12
hostname (config)#
object-group network finance
hostname (config-network)# network-object host 10.1.4.89
hostname (config-network)# network-object host 10.1.4.100
You then nest all three groups together as follows:
hostname (config)# object-group network admin
hostname (config-network)# group-object eng
hostname (config-network)# group-object hr
hostname (config-network)# group-object finance
Configure Service Objects and Service Groups
Service objects and groups identify protocols and ports. Use these objects in access control lists to
simplify your rules.
•
Configure a Service Object, page 2-4
• Configure a Service Group, page 2-5
Configure a Service Object
A service object can contain a single protocol, ICMP, ICMPv6, TCP or UDP port or port ranges.
Procedure
Step 1
Create or edit a service object using the object name.
ciscoasa(config)#
object service
object_name
Example
hostname(config)# object service web
Step 2
Add a service to the object using one of the following commands. Use the no form of the command to
remove an object.
• service protocol —The name or number (0-255) of an IP protocol. Specify ip to apply to all
protocols.