asa Object-group的疑问

luyuyou

为什么提示说这个object-group 是无效的

ciscoasa(config)# access-list out-to-in extended permit object-group ping1
ERROR: Invalid object-group type


ciscoasa(config)# show object-group      
object-group network office-server
network-object 11.1.1.1 255.255.255.255
network-object 12.1.1.1 255.255.255.255
object-group service ping
object-group service http-telnet-ftp tcp-udp
port-object eq echo
port-object eq www
port-object range 0 65535
object-group network lan
network-object 10.1.1.1 255.255.255.255
network-object 11.1.1.1 255.255.255.255
network-object 12.1.1.1 255.255.255.255
object-group protocol proto
object-group service ping1 tcp-udp
port-object range 0 65535
ciscoasa(config)#
ciscoasa(config)#

ciscoasa(config)#
ciscoasa(config)# show ver

Cisco Adaptive Security Appliance Software Version 9.5(2)204
Device Manager Version 7.5(2)

Compiled on Mon 15-Feb-16 19:00 PST by builders
System image file is "boot:/asa952-204-smp-k8.bin"
Config file at boot was "startup-config"

ciscoasa up 4 hours 56 mins

YilinChen

类型有问题呀，定义的是协议和端口，不是IP地址范围，也没看到嵌套调用

huoran1234

得先调用ip得obj，再调用协议得obj啊

18653465190

YilinChen 发表于 2019-1-28 09:00
类型有问题呀，定义的是协议和端口，不是IP地址范围，也没看到嵌套调用

跟着学习一下

Rocky

前面的网友已经提示了，楼主还不清楚的话，可以参考一下下面的文档
Solved: ASA Extended Access-List with Object Group
https://community.cisco.com/t5/f ... -group/td-p/2786204

xuxiaoxunlxl

跟着学习学习