2

When it comes to managing access rules in Cisco ASAs I always use ASDM because it's easier for me to visualize, troubleshoot and manage.

I recently created a VPN filter for a S2S IPsec VPN and noticed something strange. TCP/UDP object groups do not appear to be working as they normally do in an access rule vice ACL Manager for VPN filters. I had to create an IP object and specify source/dest ports instead.

Here's what ASDM preview enters into CLI. Keep in mind src/dst syntax for VPN filters is backwards.

using TCP object group (doesn't work):

access-list Site1_VPN_Filter line 14 extended permit tcp object-group Site2 object-group Site1 object-group rdp

using IP object group (does work):

access-list Site1_VPN_Filter line 15 extended permit object rdp-vpnf object-group Site2 object-group Site1

object groups:

object-group service rdp tcp
 port-object eq 3389
object service rdp-vpnf
 service tcp source eq 3389

I've used TCP and UDP object groups for years in access rules without problems until I tried to use one in an ACL for a VPN filter.

Is this just odd Cisco behavior explained by a bug/syntax error or is there a legit reason it has to be this way?

Appreciate any insight!

Improve this question
2
  • Keep in mind that a vpn-filter on a group-policy only affects traffic incoming through the tunnel, not traffic outgoing through the tunnel. Therefore, in your example, it seems that the RDP server you are attempting to reach is on the other end of the tunnel, since the incoming traffic has a source port of 3389.
    – user3629081
    May 10, 2018 at 17:07
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Dec 25, 2018 at 8:13

1 Answer 1

Reset to default
1

In your TCP object group variant, you defined "Any TCP from Site2 to Site1 destined to TCP 3389".

The port-object variant is "TCP sourced from 3389 from Site2 to Any TCP Site1".

Since it's reversed as you said, does this work:

access-list Site1_VPN_Filter line 14 extended permit tcp object-group Site2 object-group rdp object-group Site1

Related feature request, hopefully they get on this soon: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCsf99428

VPN Filter details for reference as well:

https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/99103-pix-asa-vpn-filter.html#anc4

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.