2

When it comes to managing access rules in Cisco ASAs I always use ASDM because it's easier for me to visualize, troubleshoot and manage.

I recently created a VPN filter for a S2S IPsec VPN and noticed something strange. TCP/UDP object groups do not appear to be working as they normally do in an access rule vice ACL Manager for VPN filters. I had to create an IP object and specify source/dest ports instead.

Here's what ASDM preview enters into CLI. Keep in mind src/dst syntax for VPN filters is backwards.

using TCP object group (doesn't work):

access-list Site1_VPN_Filter line 14 extended permit tcp object-group Site2 object-group Site1 object-group rdp 

using IP object group (does work):

access-list Site1_VPN_Filter line 15 extended permit object rdp-vpnf object-group Site2 object-group Site1 

object groups:

object-group service rdp tcp
 port-object eq 3389
object service rdp-vpnf
 service tcp source eq 3389 

I've used TCP and UDP object groups for years in access rules without problems until I tried to use one in an ACL for a VPN filter.

Is this just odd Cisco behavior explained by a bug/syntax error or is there a legit reason it has to be this way?

Appreciate any insight!

  • Keep in mind that a vpn-filter on a group-policy only affects traffic incoming through the tunnel, not traffic outgoing through the tunnel. Therefore, in your example, it seems that the RDP server you are attempting to reach is on the other end of the tunnel, since the incoming traffic has a source port of 3389. – user3629081 May 10 '18 at 17:07
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 8:13
1

In your TCP object group variant, you defined "Any TCP from Site2 to Site1 destined to TCP 3389".

The port-object variant is "TCP sourced from 3389 from Site2 to Any TCP Site1".

Since it's reversed as you said, does this work:

access-list Site1_VPN_Filter line 14 extended permit tcp object-group Site2 object-group rdp object-group Site1 

Related feature request, hopefully they get on this soon: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCsf99428

VPN Filter details for reference as well:

https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/99103-pix-asa-vpn-filter.html#anc4

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.