CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.1
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Book Title
CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.1
Adding Global Objects
View with Adobe Reader on a variety of devices
Results
Chapter: Adding Global Objects
Configuring Objects
This chapter describes how to configure reusable named objects and groups for use in your configuration, and it includes the following sections:
- Information About Objects
- Licensing Requirements for Objects
- Configuring Objects
- Monitoring Objects
- Feature History for Objects
Information About Objects
Objects are reusable components for use in your configuration. They can be defined and used in ASA configurations in the place of inline IP addresses, services, names, and so on. Objects make it easy to maintain your configurations because you can modify an object in one place and have it be reflected in all other places that are referencing it. Without objects you would have to modify the parameters for every feature when required, instead of just once. For example, if a network object defines an IP address and subnet mask, and you want to change the address, you only need to change it in the object definition, not in every feature that refers to that IP address.
Licensing Requirements for Objects
Guidelines and Limitations
Context Mode Guidelines
Supported in single and multiple context mode.
Firewall Mode Guidelines
Supported in routed and transparent firewall mode.
- Supports IPv6.
- The ASA does not support IPv6 nested network object groups, so you cannot group an object with IPv6 entries under another IPv6 object group.
- You can mix IPv4 and IPv6 entries in a network object group; you cannot use a mixed object group for NAT.
Additional Guidelines and Limitations
- Object must have unique names. While you might want to create a network object group named “Engineering” and a service object group named “Engineering,” you need to add an identifier (or “tag”) to the end of at least one object group name to make it unique. For example, you can use the names “Engineering_admins” and “Engineering_hosts” to make the object group names unique and to aid in identification.
- Objects and object groups share the same name space.
- You cannot remove an object or make an object empty if it is used in a command.
Configuring Objects
- Configuring Network Objects and Groups
- Configuring Service Objects and Service Groups
- Configuring Local User Groups
- Configuring Security Group Object Groups
- Configuring Regular Expressions
- Configuring Time Ranges
Configuring Network Objects and Groups
This section describes how to configure network objects and groups, and it includes the following topics:
- Configuring a Network Object
- Configuring a Network Object Group
Configuring a Network Object
A network object can contain a host, a network IP address, or a range of IP addresses, a fully qualified domain name (FQDN). You can also enable NAT rules on the object (excepting FQDN objects). (See Chapter 4, “Configuring Network Object NAT,” in the firewall configuration guide for more information.)
Detailed Steps
Creates a new network object. The obj_name is a text string up to 64 characters in length and can be any combination of letters, digits, and the following characters:
- underscore “_”
- dash “-”
- period “.”
The prompt changes to network object configuration mode.
<host ip_addr | subnet net_addr net_mask | range ip_addr_1 ip_addr_2 | fqdn fully_qualified_domain_name >
Assigns the IP address or FQDN to the named object.
Note You cannot configure NAT for an FQDN object.
Adds a description to the object.
Examples
To create a network object, enter the following commands:
hostname (config)# object network OBJECT1 hostname (config-network-object)# host 10.2.2.2
Configuring a Network Object Group
Network object groups can contain multiple network objects as well as inline networks. Network object groups can support a mix of both IPv4 and IPv6 addresses.
Restrictions
You cannot use a mixed IPv4 and IPv6 object group for NAT, or object groups that include FQDN objects.
Detailed Steps
Adds a network group.
The grp_id is a text string up to 64 characters in length and can be any combination of letters, digits, and the following characters:
- underscore “_”
- dash “-”
- period “.”
The prompt changes to protocol configuration mode.
(Optional) Adds a description. The description can be up to 200 characters.
Add one or more of the following group members:
Adds an object to the network object group.
Adds a host or network inline, either IPv4 or IPv6.
Adds an existing object group under this object group. The nested group must be of the same type.
Example
To create a network group that includes the IP addresses of three administrators, enter the following commands:
hostname (config)# object-group network admins hostname (config-protocol)# description Administrator Addresses hostname (config-protocol)# network-object host 10.2.2.4 hostname (config-protocol)# network-object host 10.2.2.78 hostname (config-protocol)# network-object host 10.2.2.34
Create network object groups for privileged users from various departments by entering the following commands:
hostname (config)# object-group network eng hostname (config-network)# network-object host 10.1.1.5 hostname (config-network)# network-object host 10.1.1.9 hostname (config-network)# network-object host 10.1.1.89 hostname (config)# object-group network hr hostname (config-network)# network-object host 10.1.2.8 hostname (config-network)# network-object host 10.1.2.12 hostname (config)# object-group network finance hostname (config-network)# network-object host 10.1.4.89 hostname (config-network)# network-object host 10.1.4.100
You then nest all three groups together as follows:
hostname (config)# object-group network admin hostname (config-network)# group-object eng hostname (config-network)# group-object hr hostname (config-network)# group-object finance
Configuring Service Objects and Service Groups
Service objects and groups identify protocols and ports. This section describes how to configure service objects, service groups, TCP and UDP port service groups, protocol groups, and ICMP groups, and it includes the following topics:
- Configuring a Service Object
- Configuring a Service Group
- Configuring a TCP or UDP Port Service Group
- Configuring an ICMP Group
- Configuring an ICMP Group
Configuring a Service Object
The service object can contain a protocol, ICMP, ICMPv6, TCP or UDP port or port ranges.
Detailed Steps
Creates a new service object. The obj_name is a text string up to 64 characters in length and can be any combination of letters, digits, and the following characters:
- underscore “_”
- dash “-”
- period “.”
The prompt changes to service object configuration mode.
Adds a service definition to the object.
The protocol argument specifies an IP protocol name or number. If you specify the icmp , icmp6 , tcp , or udp protocols, you can specify additional properties; for other protocols, there are no additional properties.
For icmp and icmp6 (for ICMP version 6), you can optionally include the ICMP type, such as “echo” or the type number. If you specify a type, you can optionally include an ICMP code, between 1 and 255.
For TCP and UDP, you can optionally specify the source and/or destination ports, between 0 and 65535. For a list of supported names, see the CLI help. The operator can be:
- eq—Equals the port number.
- gt—Greater than the port number.
- lt—Less than the port number.
- neq—Not equal to the port number.
- range—A range of ports. Specify two numbers separated by a space, such as range 1024 4500.
Example
To create a service object, enter the following commands:
hostname (config)# object service SERVOBJECT1 hostname (config-service-object)# service tcp destination eq ssh
Configuring a Service Group
A service object group includes a mix of protocols, if desired, including optional source and destination ports for TCP or UDP.
Detailed Steps
Adds a service group. The grp_id is a text string up to 64 characters in length and can be any combination of letters, digits, and the following characters:
- underscore “_”
- dash “-”
- period “.”
The prompt changes to service configuration mode.
Add one or more of the following group members:
Identifies the protocol name or number, between 0 and 255.
You can specify the source and/or destination ports, between 0 and 65535, for the TCP and UDP protocols; tcp-udp matches both protocols. For a list of supported names, see the CLI help. The operator can be:
- eq—Equals the port number.
- gt—Greater than the port number.
- lt—Less than the port number.
- neq—Not equal to the port number.
- range—A range of ports. Specify two numbers separated by a space, such as range 1024 4500.
Specifies that the service type is for ICMP or ICMPv6 connections. You can optionally specify the ICMP type by name or number, between 0 and 255.
The optional icmp_code specifies an ICMP code, between 1 and 255.
Specifies a service object name, created with the object service command.
Adds an existing object group under this object group. The nested group must be of the same type.
(Optional) Adds a description. The description can be up to 200 characters.
Examples
The following example shows how to add both TCP and UDP services to a service object group:
hostname(config)# object-group service CommonApps hostname(config-service-object-group)# service-object tcp destination eq ftp hostname(config-service-object-group)# service-object tcp-udp destination eq www hostname(config-service-object-group)# service-object tcp destination eq h323 hostname(config-service-object-group)# service-object tcp destination eq https hostname(config-service-object-group)# service-object udp destination eq ntp
The following example shows how to add multiple service objects to a service object group:
hostname(config)# service object SSH hostname(config-service-object)# service tcp destination eq ssh hostname(config)# service object EIGRP hostname(config-service-object)# service eigrp hostname(config)# service object HTTPS hostname(config-service-object)# service tcp source range 0 1024 destination eq https hostname(config)# object-group service Group1 hostname(config-service-object-group)# service-object object SSH hostname(config-service-object-group)# service-object object EIGRP hostname(config-service-object-group)# service-object object HTTPS
Configuring a TCP or UDP Port Service Group
A TCP or UDP service group includes a group of ports for a specific protocol (TCP, UDP, or TCP-UDP).
Adds a service group.
The object keyword adds an additional object to the service object group.
The grp_id is a text string up to 64 characters in length and can be any combination of letters, digits, and the following characters:
- underscore “_”
- dash “-”
- period “.”
Specifies the protocol for the services (ports) you want to add with either the tcp , udp , or tcp-udp keywords. Enter the tcp-udp keyword if your service uses both TCP and UDP with the same port number, for example, DNS (port53).
The prompt changes to service configuration mode.
Add one or more of the following group members:
Defines the ports in the group. Enter the command for each port or range of ports. For a list of permitted keywords and well-known port assignments, see the “Protocols and Applications” section.
Adds an existing object group under this object group. The nested group must be of the same type.
(Optional) Adds a description. The description can be up to 200 characters.
Example
To create service groups that include DNS (TCP/UDP), LDAP (TCP), and RADIUS (UDP), enter the following commands:
hostname (config)# object-group service services1 tcp-udp hostname (config-service)# description DNS Group hostname (config-service)# port-object eq domain hostname (config)# object-group service services2 udp hostname (config-service)# description RADIUS Group hostname (config-service)# port-object eq radius hostname (config-service)# port-object eq radius-acct hostname (config)# object-group service services3 tcp hostname (config-service)# description LDAP Group hostname (config-service)# port-object eq ldap
Configuring an ICMP Group
An ICMP group includes multiple ICMP types.
Detailed Steps
Adds an ICMP type object group. The grp_id is a text string up to 64 characters in length and can be any combination of letters, digits, and the following characters:
- underscore “_”
- dash “-”
- period “.”
The prompt changes to ICMP type configuration mode.
Add one or more of the following group members:
Defines the ICMP types in the group. Enter the command for each type. For a list of ICMP types, see the“ICMP Types” section.
Adds an existing object group under this object group. The nested group must be of the same type.
(Optional) Adds a description. The description can be up to 200 characters.
Example
Create an ICMP type group that includes echo-reply and echo (for controlling ping) by entering the following commands:
hostname (config)# object-group icmp-type ping hostname (config-service)# description Ping Group hostname (config-service)# icmp-object echo hostname (config-service)# icmp-object echo-reply
Configuring a Protocol Group
A protocol group contains IP protocol types.
Detailed Steps
Adds a protocol group. The obj_grp_id is a text string up to 64 characters in length and can be any combination of letters, digits, and the following characters:
- underscore “_”
- dash “-”
- period “.”
The prompt changes to protocol configuration mode.
Add one or more of the following group members:
Defines the protocols in the group. Enter the command for each protocol. The protocol is the numeric identifier of the specified IP protocol (1 to 254) or a keyword identifier (for example, icmp , tcp , or udp ). To include all IP protocols, use the keyword ip . For a list of protocols that you can specify, see the “Protocols and Applications” section.
Adds an existing object group under this object group. The nested group must be of the same type.
(Optional) Adds a description. The description can be up to 200 characters.
Example
To create a protocol group for TCP, UDP, and ICMP, enter the following commands:
hostname (config)# object-group protocol tcp_udp_icmp hostname (config-protocol)# protocol-object tcp hostname (config-protocol)# protocol-object udp hostname (config-protocol)# protocol-object icmp
Configuring Local User Groups
You can create local user groups for use in features that support the identity firewall (IDFW) by including the group in an extended ACL, which in turn can be used in an access rule, for example.
The ASA sends an LDAP query to the Active Directory server for user groups globally defined in the Active Directory domain controller. The ASA imports these groups for identity-based rules. However, the ASA might have localized network resources that are not defined globally that require local user groups with localized security policies. Local user groups can contain nested groups and user groups that are imported from Active Directory. The ASA consolidates local and Active Directory groups.
A user can belong to local user groups and user groups imported from Active Directory.
Prerequisites
Detailed Steps
object-group user user _ group _name
hostname(config)# object-group user users1
Defines object groups that you can use to control access with the Identity Firewall.
Add one or more of the following group members:
user domain_NetBIOS_name \ user_name
hostname(config-user-object-group)# user SAMPLE\users1
Specifies the user to add to the access rule.
The user_name can contain any character including [a-z], [A-Z], [0-9], [!@#$%^&()-_<>. ]. If domain_NetBIOS_name \ user _ name contains a space, you must enclose the domain name and user name in quotation marks.
The user _ name can be part of the LOCAL domain or a user imported by the ASA from Active Directory domain.
If the domain_NetBIOS_name is associated with a AAA server, the user _ name must be the Active Directory sAMAccountName, which is unique, instead of the common name (cn), which might not be unique.
The domain_NetBIOS_name can be LOCAL or the actual domain name as specified in user — identity domain domain_NetBIOS_name aaa — server aaa _ serve r_ group _ tag command.
Adds an existing object group under this object group. The nested group must be of the same type.
(Optional) Adds a description. The description can be up to 200 characters.
Configuring Security Group Object Groups
You can create security group object groups for use in features that support Cisco TrustSec by including the group in an extended ACL, which in turn can be used in an access rule, for example.
When integrated with Cisco TrustSec, the ASA downloads security group information from the ISE. The ISE acts as an identity repository, by providing Cisco TrustSec tag to user identity mapping and Cisco TrustSec tag to server resource mapping. You provision and manage security group ACLs centrally on the ISE.
However, the ASA might have localized network resources that are not defined globally that require local security groups with localized security policies. Local security groups can contain nested security groups that are downloaded from the ISE. The ASA consolidates local and central security groups.
To create local security groups on the ASA, you create a local security object group. A local security object group can contain one or more nested security object groups or Security IDs or security group names. User can also create a new Security ID or security group name that does not exist on the ASA.
You can use the security object groups you create on the ASA to control access to network resources. You can use the security object group as part of an access group or service policy.
Prerequisites
Detailed Steps
object-group security objgrp_name
ciscoasa(config)# object-group security mktg-sg
Creates a security group object.
Where objgrp_name is the name for the group entered as a 32-byte case sensitive string.
The objgrp_name can contain any character including [a-z], [A-Z], [0-9], [!@#$%^&()-_<>. ].
Add one or more of the following group members:
security-group <tag sgt# | name sg_name >
ciscoasa(config)# security-group name mktg
Specifies the type of security group object as either an inline tag or a named object.
- tagsgt# —Enter a number from 1 to 65533 for a Tag security type.
- namesg_name —Enter a 32-byte case-sensitive string for a Name security type. The sg_name can contain any character including [a-z], [A-Z], [0-9], [!@#$%^&()-_<>. ].
An SGT is assigned to a device through IEEE 802.1X authentication, web authentication, or MAC authentication bypass (MAB) by the ISE. Security group names are created on the ISE and provide user-friendly names for security groups. The security group table maps SGTs to security group names.
Adds an existing object group under this object group. The nested group must be of the same type.
(Optional) Adds a description. The description can be up to 200 characters.
Examples
The following example shows how to configure a security group object:
ciscoasa(config)# object-group security mktg-sg ciscoasa(config)# security-group name mktg ciscoasa(config)# security-group tag 1
The following example shows how to configure a security group object:
ciscoasa(config)# object-group security mktg-sg-all ciscoasa(config)# security-group name mktg-managers ciscoasa(config)# group-object mktg-sg // nested object-group
Configuring Regular Exp ressions
- Creating a Regular Expression
- Creating a Regular Expression Class Map
Creating a Regular Expression
A regular expression matches text strings either literally as an exact string, or by using metacharacters so that you can match multiple variants of a text string. You can use a regular expression to match the content of certain application traffic; for example, you can match a URL string inside an HTTP packet.
Guidelines
Use Ctrl+V to escape all of the special characters in the CLI, such as question mark (?) or a tab. For example, type d[Ctrl+V]?g to enter d?g in the configuration.
See the regex command in the command reference for performance impact information when matching a regular expression to packets.
Note As an optimization, the ASA searches on the deobfuscated URL. Deobfuscation compresses multiple forward slashes (/) into a single slash. For strings that commonly use double slashes, like “http://”, be sure to search for “http:/” instead.
Table 17-1 lists the metach aracters that have special meanings.
Table 17-1 regex Metacharacters
Matches any single character. For example, d.g matches dog, dag, dtg, and any word that contains those characters, such as doggonnit.
A subexpression segregates characters from surrounding characters, so that you can use other metacharacters on the subexpression. For example, d(o|a)g matches dog and dag, but do|ag matches do and ag. A subexpression can also be used with repeat quantifiers to differentiate the characters meant for repetition. For example, ab(xy)<3>z matches abxyxyxyz.
Matches either expression it separates. For example, dog|cat matches dog or cat.
A quantifier that indicates that there are 0 or 1 of the previous expression. For example, lo?se matches lse or lose.
Note You must enter Ctrl+V and then the question mark or else the help function is invoked.
A quantifier that indicates that there are 0, 1 or any number of the previous expression. For example, lo*se matches lse, lose, loose, and so on.
A quantifier that indicates that there is at least 1 of the previous expression. For example, lo+se matches lose and loose, but not lse.
Minimum repeat quantifier
Repeat at least x times. For example, ab(xy)<2,>z matches abxyxyz, abxyxyxyz, and so on.
Matches any character in the brackets. For example, [abc] matches a, b, or c.
Negated character class
Matches a single character that is not contained within the brackets. For example, [^abc] matches any character other than a, b, or c. [^A-Z] matches any single character that is not an uppercase letter.
Character range class
Matches any character in the range. [a-z] matches any lowercase letter. You can mix characters and ranges: [abcq-z] matches a, b, c, q, r, s, t, u, v, w, x, y, z, and so does [ a-cq-z] .
The dash (-) character is literal only if it is the last or the first character within the brackets: [abc-] or [-abc] .
Preserves trailing or leading spaces in the string. For example, “ test” preserves the leading space when it looks for a match.
Specifies the beginning of a line.
When used with a metacharacter, matches a literal character. For example, \[ matches the left square bracket.
When character is not a metacharacter, matches the literal character.
Matches a carriage return 0x0d.
Matches a new line 0x0a.
Matches a tab 0x09.
Matches a form feed 0x0c.
Escaped hexadecimal number
Matches an ASCII character using hexadecimal (exactly two digits).
Escaped octal number
Matches an ASCII character as octal (exactly three digits). For example, the character 040 represents a space.
Detailed Steps
Step 1 To test a regular expression to make sure it matches what you think it will match, enter the following command:
ciscoasa(config)# test regex input_text regular_expression
Where the input_text argument is a string you want to match using the regular expression, up to 201 characters in length.
The regular_expression argument can be up to 100 characters in length.
Use Ctrl+V to escape all of the special characters in the CLI. For example, to enter a tab in the input text in the test regex command, you must enter test regex “test[Ctrl+V Tab]” “test\t” .
If the regular expression matches the input text, you see the following message:
INFO: Regular expression match succeeded.
If the regular expression does not match the input text, you see the following message:
INFO: Regular expression match failed.
Step 2 To add a regular expression after you tested it, enter the following command:
ciscoasa(config)# regex name regular_expression
Where the name argument can be up to 40 characters in length.
The regular_expression argument can be up to 100 characters in length.
Examples
The following example creates two regular expressions for use in an inspection policy map:
ciscoasa(config)# regex url_example example\.com ciscoasa(config)# regex url_example2 example2\.com
Creating a Regular Express ion Class Map
A regular expression class map identifies one or more regular expressions. You can use a regular expression class map to match the content of certain traffic; for example, you can match URL strings inside HTTP packets.
Prerequisites
Create one or more regular expressions according to the “Creating a Regular Expression” section.
Detailed Steps
Step 1 Create a class map by entering the following command:
ciscoasa(config)# class-map type regex match-any class_map_name ciscoasa(config-cmap)#
Where class_map_name is a string up to 40 characters in length. The name “class-default” is reserved. All types of class maps use the same name space, so you cannot reuse a name already used by another type of class map.
The match-any keyword specifies that the traffic matches the class map if it matches at least one of the regular expressions.
The CLI enters class-map configuration mode.
Step 2 (Optional) Add a description to the class map by entering the following command:
ciscoasa(config-cmap)# description string
Step 3 Identify the regular expressions you want to include by entering the following command for each regular expression:
ciscoasa(config-cmap)# match regex regex_name
Examples
The following example creates two regular expressions, and adds them to a regular expression class map. Traffic matches the class map if it includes the string “example.com” or “example2.com.”
ciscoasa(config)# regex url_example example\.com ciscoasa(config)# regex url_example2 example2\.com ciscoasa(config)# class-map type regex match-any URLs ciscoasa(config-cmap)# match regex url_example ciscoasa(config-cmap)# match regex url_example2
Configuring Time Ranges
Create a reusable component that defines starting and ending times that can be applied to various security features. Once you have defined a time range, you can select the time range and apply it to different options that require scheduling.
The time range feature lets you define a time range that you can attach to traffic rules, or an action. For example, you can attach an ACL to a time range to restrict access to the ASA.
A time range consists of a start time, an end time, and optional recurring entries.
Guidelines
- Multiple periodic entries are allowed per time range. If a time range has both absolute and periodic values specified, then the periodic values are evaluated only after the absolute start time is reached, and they are not further evaluated after the absolute end time is reached.
- Creating a time range does not restrict access to the device. This procedure defines the time range only.
Detailed Steps
Identifies the time-range name.
Do one of the following:
Specifies a recurring time range.
You can specify the following values for days-of-the-week :
- monday , tuesday , wednesday , thursday , friday , saturday , or sunday .
- daily
- weekdays
- weekend
The time is in the format hh : mm . For example, 8:00 is 8:00 a.m. and 20:00 is 8:00 p.m.
Specifies an absolute time range.
The time is in the format hh : mm . For example, 8:00 is 8:00 a.m. and 20:00 is 8:00 p.m.
The date is in the format day month year ; for example, 1 january 2006 .
Examples
The following is an example of an absolute time range beginning at 8:00 a.m. on January 1, 2006. Because no end time and date are specified, the time range is in effect indefinitely.
ciscoasa(config)# time-range for2006 ciscoasa(config-time-range)# absolute start 8:00 1 january 2006
The following is an example of a weekly periodic time range from 8:00 a.m. to 6:00 p.m on weekdays:
ciscoasa(config)# time-range workinghours ciscoasa(config-time-range)# periodic weekdays 8:00 to 18:00
Monitoring Objects
To monitor objects and groups, enter the following commands:
Displays the access list entries that are expanded out into individual entries without their object groupings.
Displays all current object groups.
Displays the current object groups by their group ID.
Displays the current object groups by their group type.
Feature History for Objects
Table 17-2 lists each feature change and the platform release in which it was implemented.
Table 17-2 Feature History for Object Groups
Object groups simplify ACL creation and maintenance.
We introduced or modified the following commands: object-group protocol , object-group network , object-group service , object-group icmp_type .
Regular expressions and policy maps
Regular expressions and policy maps were introduced to be used under inspection policy maps. The following commands were introduced: class-map type regex , regex , match regex .
Object support was introduced.
We introduced or modified the following commands: object-network , object-service , object-group network , object-group service , network object , access-list extended , access-list webtype , access-list remark .
User Object Groups for Identity Firewall
User object groups for identity firewall were introduced.
We introduced the following commands: object-network user , user .
Mixed IPv4 and IPv6 network object groups
Previously, network object groups could only contain all IPv4 addresses or all IPv6 addresses. Now network object groups can support a mix of both IPv4 and IPv6 addresses.
Note You cannot use a mixed object group for NAT.
We modified the following commands: object-group network .
Security Group Object Groups for Cisco TrustSec
Security group object groups for TrustSec were introduced.
We introduced the following commands: object-network security , security .
Extended ACLand object enhancement to filter ICMP traffic by ICMP code
ICMP traffic can now be permitted/denied based on ICMP code.
We introduced or modified the following commands: access-list extended , service-object , service .
Configuring ACL for DNS
Just want to double check my work here, but the domain port is supposed to be specified with the actual DNS server, correct? I want to only allow the VLAN 5.5.5.0/24 to communicate with this server for DNS. For example, if my DNS server is 1.1.1.1, the ACLs would look like this:
VLAN 10 is the 5.5.5.0/24 network. I’m getting confused as to where to place the eq domain command. I’m assuming you place the domain command on the actual DNS server 1.1.1.1. By the way, the /24 notation is accepted on Cisco NX-OS and the addresses are not literal. Can someone confirm that the syntax command is correct? Thanks.
3 Answers 3
You are on the right way but is convenient to add the sequence number at the first place i.e:
You could add the «log» command at the end in order to see the hits of the rule if you have doubts ie:
One thing to think about with the outbound ACL is that you probably want to apply it as close to the source as possible, as an inbound ACL. That prevents you from unnecessarily routing traffic that is destined to be dropped. Filtering traffic inbound where possible saves routing resources.
Also, for your outbound ACL, you put the eq domain at then end of the ACL entry.
Another thing is that the ACLs have an implicit deny ip any any as the last ACL entry, so you probably need a permit ip any any as the last ACL entry.
Your ACL is correct for udp/53, which is the port that most DNS resolution occurs on.
While DNS queries normally run over UDP/53, they can also run over TCP/53. If a DNS A-record has over (approximately) 17 IP addresses, it will exceed the size of one DNS UDP packet and normal DNS resolution will use tcp/53. This is a rare case, and most network administrators avoid putting so many A-records in their entries. But to be correct, to enable DNS resolution, you need to allow your clients to reach your DNS server on both udp and tcp port 53.
I don’t have operational DNSSEC experience but internet searches seem to indicate that it also uses tcp/53. If true that’s another reason to permit tcp 53.
DNS zone transfers use tcp/53. Make sure your DNS servers are configured to only allow zone transfers to specific servers you allow. That protection belongs in your DNS server configuration, not ACL configuration. Test it by trying to zone transfer from an «unauthorized» host!
Enough discussion about the need for tcp/53 and zone transfer security. The way to avoid confusion is to understand that tcp/udp sockets have 5 components:
In addition tcp sockets can have «flags». The most useful one for ACLs is the «established» flag, which is included in tcp responses.
Here are the 4 sockets you are dealing with:
Here’s the (correct) ACL line you had for client to server UDP case (socket #1)
Format is as follows:
if source-port is not listed, then source port is any. That is what you want since the actual source port ranges from 1024-65535. For performance reasons its best to avoid port «range» commands in ACLs.
Here’s your reply ACL line for socket #2:
That’s also correct for socket 2, which has source port 53 and destination port 1024-65535 (so you use the implicit any destination port).
Adding in the TCP cases:
Of course, if you actually apply that acl, everything else will break on that vlan because of the implicit «deny ip any any» at the end.
I personally use «permit tcp any any established» in most of my ACLs, which eliminates your socket #4 line. I put that first in the ACL for performance reasons.
Эволюция
Statefull фильтрация будет ломаться на ассиметричных потоках трафика. Требуется специальный функционал для синхронизации состояний.
В некоторых протоколах есть уловки для использования простых пакет-фильтров, например FTP PASV.
стартовый конфиг
настроить роутинг
Сканируем NMAP снаружи внутрь, изнутри наружу — видно всё
добавить ACL
nmap -sS -sU -T4 -A -v 10.111.0.2 Не видно ничего
Добавить порт источника, якобы 80, или 53 для udp nmap -sS -sU -T4 -A -v -g 80 10.111.0.2 Видно всё
Настроить рефлексив ACL, для всего TCP
nmap -sS -T4 -A -v -Pn 10.111.0.2 Не видно ничего
Сканируем изнутри наружу nmap -p 1-65535 -T5 -A -v -Pn 212.192.64.74
Наблюдаем как пухнет таблица list fw и CPU load
Включить CBAC
nmap -sS -T4 -A -v -Pn 10.111.0.2 Не видно ничего
Сканируем изнутри наружу nmap -p 1-65535 -T5 -A -v -Pn 212.192.64.74 Видно всё Наблюдаем как растет CPU load, а таблица сессий не растет от полуоткрытых )))
Ограничиваем количество полуоткрытых соединений на хост назначения
Сканируем изнутри наружу nmap -p 1-65535 -T5 -A -v -Pn 212.192.64.74 Ничего не видно — срабатывает ограничение на халф-опен
.Cisco IOS Software, 1841 Software (C1841-ADVIPSERVICESK9-M), Version 12.4(25g)
Contact US
Thanks. We have received your request and will respond promptly.
Come Join Us!
- Talk With Other Members
- Be Notified Of Responses
To Your Posts - Keyword Search
- One-Click Access To Your
Favorite Forums - Automated Signatures
On Your Posts - Best Of All, It’s Free!
Posting Guidelines
Promoting, selling, recruiting, coursework and thesis posting is forbidden.
eq domain?
- Forum
- Search
- FAQs
- Links
- MVPs
eq domain?
eq domain?
quick one — on an access list, what does «eq domain» mean?
access-list myname permit tcp 1.1.1.1 255.255.255.0 any eq domain
RE: eq domain?
For common layer-4 protocols the PIX (and other Cisco devices) knows the port numbers and uses ‘friendly’ names instead of the actual port number. In this case it references DNS over TCP (port 53).
In the acl listed it means permit TCP from the source host 1.1.1.1 to anywhere where the destination TCP port is 53.
RE: eq domain?
Red Flag Submitted
Thank you for helping keep Tek-Tips Forums free from inappropriate posts.
The Tek-Tips staff will check this out and take appropriate action.
Reply To This Thread
Posting in the Tek-Tips forums is a member-only feature.
Click Here to join Tek-Tips and talk with other members! Already a Member? Login
