Cisco ASA Object Group for Access-List

Imagine you have to manage a Cisco ASA firewall that has hundreds of hosts and dozens of servers behind it, and for each of these devices we require access-list rules that permit or deny traffic.

With so many devices you will have a LOT of access-list statements and it might become an administrative nightmare to read, understand and update the access-list.

To make our lives a bit easier, Cisco introduced the object-group on Cisco ASA Firewalls (and also on IOS routers since IOS 12.4.20T).

An object-group lets you “group” objects, this could be a collection of IP addresses, networks, port numbers, etc. Instead of creating an access-list with many different statements we can refer to an object-group. This makes the access-list smaller and easier to read. Whenever you make changes in the object-group, these are also reflected in the access-list.

There are different types of object groups, let’s take a look what options we have on the ASA:

ASA1(config)# object-group ?

configure mode commands/options:
  icmp-type  Specifies a group of ICMP types, such as echo
  network    Specifies a group of host or subnet IP addresses
  protocol   Specifies a group of protocols, such as TCP, etc
  security   Specifies identity attributes such as security-group
  service    Specifies a group of TCP/UDP ports/services
  user       Specifies single user, local or import user group

Let me give a quick explanation of each object-group:

• icmp-type can be used to select all the different ICMP types, for example echo, echo-reply, traceroute, unreachable, etc.
• network is used to select IP addresses and/or network addresses.
• protocol lets you select an entire protocol. For example, TCP, UDP, GRE, ESP, AH, OSPF, EIGRP, and many others.
• security is used for Cisco TrustSec.
• service is used to select TCP and/or UDP port numbers.
• user is to select local user groups for Identity Firewall.

In this lesson we will focus on network (used for IP addresses / network addresses) and service (used for TCP/UDP port numbers).

We will take a look at a couple of examples and you will see why object groups are very useful. I’ll start with a simple example for servers in the DMZ. Let’s say we have five web servers in the DMZ. This means we require access to TCP port 80 for their IP addresses. Our access-list could look like this:

ASA1(config)# access-list HTTP_TO_DMZ permit tcp any host 192.168.3.1 eq 80
ASA1(config)# access-list HTTP_TO_DMZ permit tcp any host 192.168.3.2 eq 80
ASA1(config)# access-list HTTP_TO_DMZ permit tcp any host 192.168.3.3 eq 80
ASA1(config)# access-list HTTP_TO_DMZ permit tcp any host 192.168.3.4 eq 80
ASA1(config)# access-list HTTP_TO_DMZ permit tcp any host 192.168.3.5 eq 80

This will work but we require 5 statements in our access-list. Let’s see if we can make this smaller by using an object-group. First i’ll delete this access-list:

ASA1(config)# clear configure access-list HTTP_TO_DMZ

Now I will create a network object-group where I configure the IP addresses of all my servers in the DMZ:

ASA1(config)# object-group network WEB_SERVERS
ASA1(config-network-object-group)# network-object host 192.168.3.1
ASA1(config-network-object-group)# network-object host 192.168.3.2
ASA1(config-network-object-group)# network-object host 192.168.3.3
ASA1(config-network-object-group)# network-object host 192.168.3.4
ASA1(config-network-object-group)# network-object host 192.168.3.5

The object-group is ready, now we will create the access-list again and we’ll use the object-group in it:

ASA1(config)# access-list HTTP_TO_DMZ permit tcp any object-group WEB_SERVERS eq 80

I reduced the access-list from five statements to just one statement. Instead of specifying each IP address separately, I refer to the object-group. This is useful right? If you look in the configuration you will find this single entry:

ASA1(config)# show run | include HTTP_TO_DMZ
access-list HTTP_TO_DMZ extended permit tcp any object-group WEB_SERVERS eq www

However if you look at the access-list, it will show you both the object-group and the specific entries:

ASA1(config)# show access-list HTTP_TO_DMZ 
access-list HTTP_TO_DMZ; 5 elements; name hash: 0x6ce713ae
access-list HTTP_TO_DMZ line 1 extended permit tcp any object-group WEB_SERVERS eq www (hitcnt=0) 0x0964f55b 
  access-list HTTP_TO_DMZ line 1 extended permit tcp any host 192.168.3.1 eq www (hitcnt=0) 0x461c3d40 
  access-list HTTP_TO_DMZ line 1 extended permit tcp any host 192.168.3.2 eq www (hitcnt=0) 0x3413c8db 
  access-list HTTP_TO_DMZ line 1 extended permit tcp any host 192.168.3.3 eq www (hitcnt=0) 0x5ee1c727 
  access-list HTTP_TO_DMZ line 1 extended permit tcp any host 192.168.3.4 eq www (hitcnt=0) 0x089ddde7 
  access-list HTTP_TO_DMZ line 1 extended permit tcp any host 192.168.3.5 eq www (hitcnt=0) 0x68e87688

The previous example should give you a good idea how you can use object groups to make your access-list smaller. Let’s continue by adding some more requirements. Let’s say that our web servers require access to some extra TCP ports…besides TCP port 80 we also need access to 22, 23 and 443.

We could update our access-list to add these ports:

ASA1(config)# access-list HTTP_TO_DMZ permit tcp any object-group WEB_SERVERS eq 22
ASA1(config)# access-list HTTP_TO_DMZ permit tcp any object-group WEB_SERVERS eq 23
ASA1(config)# access-list HTTP_TO_DMZ permit tcp any object-group WEB_SERVERS eq 443

This does the job but now we have 4 statements…one for each TCP port. Instead of specifying the TCP port in each statement, we will create another object-group that combines all our TCP ports. Here’s what it will look like: