KB ID 0001668
Problem
I like object-groups, they can make your firewall configs a lot smaller/neater and if you need to add a host, network, range, or port, then you can simply add the new requirement to an existing group. But what if you want to allow both UDP and TCP ports, you can create a service group for TCP and add the ports and a service group for UDP and add the ports, and add them into your ACL where you would expect ports to be, (at the end of the ACL,) like so;
[box]
! object-group service Obj-TCP-Ports tcp port-object eq www port-object eq https object-group service Obj-UDP-Ports udp port-object eq 8080 port-object eq 8088 ! access-list inbound extended permit tcp any host 192.168.1.10 object-group Obj-TCP-Ports access-list inbound extended permit udp any host 192.168.1.10 object-group Obj-UDP-Ports !
[/box]
But that still means creating a group for TCP and UDP right? Well no, you can mix them you just need to move the object-group in the ACL.
Solution
First create a Service group like this;
[box]
! object-group service OBJ-Service-Ports service-object tcp eq www service-object tcp eq https service-object udp eq 8080 service-object udp eq 8088 ![/box]
Note: What this actually does is create ‘destination port’ objects, if you didn’t already know, if you are connecting to a web server on port 443 (https) for example, the source port can be any port number, it’s the destination port number that is 443. (If you’ve ever worked on a Symantec/SEF/Velociraptor firewall this would be more important).
Then place that service group in the ACL where you would normally specify the PROTOCOL like so;
[box]
! access-list inbound permit object-group OBJ-Service-Ports any host 192.168.1.10 ![/box]
Much simpler!
Related Articles, References, Credits, or External Links
NA
