How can i add a host to an already existing object group in ASA

Question

How can i add a host to an already existing object group in ASA, without over-writing the already existing members ? Please suggest

For Example:

Object group TEST has 2 members, and i want to add one more host (192.168.10.10) to TEST, will the below add the one host or replace the existing 2 hosts with the new host

ASA (config)#object-group network TEST
ASA (config-network)#network-object host 192.168.10.10
ASA (config-network)# exit

Answer 1

this type of object group is calles Network Object Group , so to create a network group that includes the IP addresses of three administrators for example , enter the following commands:

hostname (config)# object-group network admins  
hostname (config-protocol)# description Administrator Addresses  
hostname (config-protocol)# network-object host 10.1.1.4  
hostname (config-protocol)# network-object host 10.1.1.78  
hostname (config-protocol)# network-object host 10.1.1.34

there is no problem to add any entry to same exiting Object Group ,it won't remove any existing entry

Cisco ASA 5500 Series Configuration Guide

by the way ASDM will be batter in such firewall configuration and will give you better visibility.

Answer 2

Your example is adding the host to the object-group. This will not remove any existing entries. To remove hosts you need to do the following:

object-group network TEST
 no network-object <object-to-be-removed>

Answer 3

Java 7 version 45 and 63 worked for me with asdm, lower your java security setting to medium and whitelist the ip/hostname of the ASA.

specify object group then add the network object-host followed by the IP desired.

These two links cover just about any issue you could have...good luck!

http://www.gomjabbar.com/2011/08/06/cisco-asa-device-management-%E2%80%93-debugging-asdm/#sthash.1JEplDUI.dpbs

http://www.winsysadminblog.com/2016/01/log-asdm-cisco-asa-get-unable-launch-device-manager-error/

Answer 4

A better way to create object groups is to fully embrace object orientated programing:

Create objects

object network test
 host 1.1.1.1
object network test2
 host 2.2.2.2

Add the object to a object-group

object-group network testing
 network-object object test

Use the object-group in a access list

access-list test_acl extended permit ip object test2 object-group testing

The access list will look like this:

ciscoasa# sh access-list test_acl
access-list test_acl; 1 elements; name hash: 0x71b1e4a4
access-list test_acl line 1 extended permit ip object test2 object-group testing (hitcnt=0) 0x4398ab6a
  access-list testing line 1 extended permit ip host 2.2.2.2 host 1.1.1.1 (hitcnt=0) 0xf5676f24

If you ever need to change the ip of the object "test" you only have to change it in one place instead of digging through object groups

Adding additional objects is easy, just create another object and add it to the group using the same steps outlined above.

ciscoasa(config)# object network test4
ciscoasa(config-network-object)# host 3.3.3.3
ciscoasa(config-network-object)# object-group network testing
ciscoasa(config-network-object-group)# network-object object test4
ciscoasa(config-network-object-group)# end
ciscoasa# sh access-list test_acl
access-list test_acl; 2 elements; name hash: 0x71b1e4a4
access-list test_acl line 1 extended permit ip object test2 object-group testing (hitcnt=0) 0x4398ab6a
  access-list test_acl line 1 extended permit ip host 2.2.2.2 host 1.1.1.1 (hitcnt=0) 0xf5676f24
  access-list test_acl line 1 extended permit ip host 2.2.2.2 host 3.3.3.3 (hitcnt=0) 0x0be1c62a