6

How can i add a host to an already existing object group in ASA, without over-writing the already existing members ? Please suggest

For Example:

Object group TEST has 2 members, and i want to add one more host (192.168.10.10) to TEST, will the below add the one host or replace the existing 2 hosts with the new host

ASA (config)#object-group network TEST
ASA (config-network)#network-object host 192.168.10.10
ASA (config-network)# exit
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Jan 5, 2021 at 2:46

4 Answers 4

6

this type of object group is calles Network Object Group , so to create a network group that includes the IP addresses of three administrators for example , enter the following commands:

hostname (config)# object-group network admins  
hostname (config-protocol)# description Administrator Addresses  
hostname (config-protocol)# network-object host 10.1.1.4  
hostname (config-protocol)# network-object host 10.1.1.78  
hostname (config-protocol)# network-object host 10.1.1.34

there is no problem to add any entry to same exiting Object Group ,it won't remove any existing entry

Cisco ASA 5500 Series Configuration Guide

by the way ASDM will be batter in such firewall configuration and will give you better visibility.

4
  • I'd actually stay away from ASDM. I found it always to be slow, clunky and not quite straight forward. Doing the config yourself is maybe a bit difficult at first, but at some point it makes just a lot of sense and it is really easy since you can prepare configs and paste them in
    – mike.b93
    Aug 22, 2016 at 12:39
  • it is always JAVA problem
    – Gadeliow
    Aug 23, 2016 at 20:53
  • Where there is Java, there is a problem :D
    – mike.b93
    Aug 25, 2016 at 6:20
  • may you dig in cisco communities to find stable version . for me jre-7u45-windows-x64 was the most stable one
    – Gadeliow
    Aug 28, 2016 at 9:33
4

Your example is adding the host to the object-group. This will not remove any existing entries. To remove hosts you need to do the following:

object-group network TEST
 no network-object <object-to-be-removed>
0

Java 7 version 45 and 63 worked for me with asdm, lower your java security setting to medium and whitelist the ip/hostname of the ASA.

specify object group then add the network object-host followed by the IP desired.

These two links cover just about any issue you could have...good luck!

http://www.gomjabbar.com/2011/08/06/cisco-asa-device-management-%E2%80%93-debugging-asdm/#sthash.1JEplDUI.dpbs

http://www.winsysadminblog.com/2016/01/log-asdm-cisco-asa-get-unable-launch-device-manager-error/

0

A better way to create object groups is to fully embrace object orientated programing:

Create objects

object network test
 host 1.1.1.1
object network test2
 host 2.2.2.2

Add the object to a object-group

object-group network testing
 network-object object test

Use the object-group in a access list

access-list test_acl extended permit ip object test2 object-group testing

The access list will look like this:

ciscoasa# sh access-list test_acl
access-list test_acl; 1 elements; name hash: 0x71b1e4a4
access-list test_acl line 1 extended permit ip object test2 object-group testing (hitcnt=0) 0x4398ab6a
  access-list testing line 1 extended permit ip host 2.2.2.2 host 1.1.1.1 (hitcnt=0) 0xf5676f24

If you ever need to change the ip of the object "test" you only have to change it in one place instead of digging through object groups

Adding additional objects is easy, just create another object and add it to the group using the same steps outlined above.

ciscoasa(config)# object network test4
ciscoasa(config-network-object)# host 3.3.3.3
ciscoasa(config-network-object)# object-group network testing
ciscoasa(config-network-object-group)# network-object object test4
ciscoasa(config-network-object-group)# end
ciscoasa# sh access-list test_acl
access-list test_acl; 2 elements; name hash: 0x71b1e4a4
access-list test_acl line 1 extended permit ip object test2 object-group testing (hitcnt=0) 0x4398ab6a
  access-list test_acl line 1 extended permit ip host 2.2.2.2 host 1.1.1.1 (hitcnt=0) 0xf5676f24
  access-list test_acl line 1 extended permit ip host 2.2.2.2 host 3.3.3.3 (hitcnt=0) 0x0be1c62a

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.