1

I'm not too familar with the ASA, is there a way to make this ACL into an object group and be easier to maintain?

access-list VPN-ALLOCATIONS extended permit esp 172.16.1.128 255.255.255.252 172.16.32.128 255.255.255.252
access-list VPN-ALLOCATIONS extended permit esp 172.16.32.128 255.255.255.252 172.16.1.128 255.255.255.252
access-list VPN-ALLOCATIONS extended permit esp 172.16.1.128 255.255.255.252 172.16.2.128 255.255.255.252
access-list VPN-ALLOCATIONS extended permit esp 172.16.2.128 255.255.255.252 172.16.1.128 255.255.255.252
access-list VPN-ALLOCATIONS extended permit esp 172.16.1.128 255.255.255.252 172.16.10.128 255.255.255.252
access-list VPN-ALLOCATIONS extended permit esp 172.16.10.128 255.255.255.252 172.16.1.128 255.255.255.252
access-list VPN-ALLOCATIONS extended permit esp 172.16.1.128 255.255.255.252 172.16.33.128 255.255.255.252
access-list VPN-ALLOCATIONS extended permit esp 172.16.33.128 255.255.255.252 172.16.1.128 255.255.255.252
access-list VPN-ALLOCATIONS extended permit udp any any eq isakmp
access-list VPN-ALLOCATIONS extended permit icmp any any

This is an attempt I made that works, but I feel like it might be more than I need:

object-group network VPN-SITES
 network-object host 172.16.1.130
 network-object host 172.16.2.130
 network-object host 172.16.10.130
 network-object host 172.16.32.130
 network-object host 172.16.33.130
object-group protocol APPROVED-PROTO
 protocol-object esp
 protocol-object icmp
!
access-list TEST extended permit object-group APPROVED-PROTO object-group VPN-SITES object-group VPN-SITES
access-list TEST extended permit object-group APPROVED-PROTO host 172.16.1.130 object-group VPN-SITES
access-list TEST extended permit object-group APPROVED-PROTO object-group VPN-SITES host 172.16.1.130
access-list TEST extended permit udp host 172.16.1.130 eq isakmp object-group VPN-SITES eq isakmp
access-list TEST extended permit udp object-group VPN-SITES eq isakmp host 172.16.1.130 eq isakmp
  • 2
    Not really, since you don't have all of the sources talking to all of the same destinations. You could make a couple different groups but it won't really make it easier to manage in this case. – Jesse P. Mar 1 at 17:38
  • @JesseP. i made an attempt. do you see anything wrong with this? – Kyle Rogers Mar 1 at 18:11
  • I added an answer so I could provide proper formatting and make it easier to read. – Jesse P. Mar 1 at 18:42
  • Please mark the answer I provided as the solution to your question, or provide your own answer and mark it as such, so this question/topic does not keep coming up until the end of time. Thank you. – Jesse P. Mar 14 at 16:39
2

You do have a piece that's redundant:

access-list TEST extended permit object-group APPROVED-PROTO host 172.16.1.130 object-group VPN-SITES
access-list TEST extended permit object-group APPROVED-PROTO object-group VPN-SITES host 172.16.1.130

Because 172.16.1.130 is a part of that object-group (VPN-SITES), which you have in use in both the source and destination positions on the first line of your ACL, there is no need to further permit that host.

So, you can remove those 2 lines.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.