Cisco ASA Object Groups Explained

In large networks especially Data Centers, the ACLs can be too big – up to hundreds of lines and difficult to configure and manage.

Object group-based ACLs provide the solution here – these are smaller, readable, and easier to configure and manage.

Not only are the static ACL, but also dynamic ACL deployments for large user environments are befitted.

Related – ACL on Router vs Firewall

The Object Groups feature allows us to classify users, devices, or protocols into groups and apply those groups to access control lists (ACLs).

This lets us create access control policies for groups and use object groups instead of IP addresses, protocols or even port numbers which are used in conventional ACLs.

The approach is to use a single ACE to allow an entire group of users to access a group of user or server groups.

Object Groups supports two types of object groups for grouping ACL parameters –

1. Network object groups
2. Service object groups

A Network object group is a group of any of the following objects:

• Any IP address
• Host IP addresses
• Hostnames
• Other network object groups
• Ranges of IP addresses
• Subnets

Related – Cisco ASA 5505 Factory Reset

A service object group is a group of any of the following objects:

• Source and destination protocol ports (Like telnet, SNMP etc)
• ICMP types (such as echo, echo-reply etc)
• Top-level protocols (such as TCP, UDP etc)
• Other service object groups

A Scenario will help understand the concept of Object groups and how with simple commands, we can reduce creating big ACL lines into just a few ones –

The requirement is to allow client machines to access some specific servers for services like Telnet, HTTP and SMTP.

Below table enlists the requirements –

Related – Cisco ASA Interview Questions

Configuration of Object Groups –

To reiterate , the 2 Group types used here are –

1. Network – To specify IP addresses and subnets
2. Service – To specify port numbers and protocols

Now we put it together in an ACL as below –

So in all total 216 line will be created which will encompass all the USER and SERVER communication ACLs along with port numbers and protocols.

Hence, to summarise a single line (via Object Groups) has done the work what 216 lines were originally supposed to perform via ACLs.

ABOUT THE AUTHOR

Rashmi Bhardwaj

I am here to share my knowledge and experience in the field of networking with the goal being – “The more you share, the more you learn.”

I am a biotechnologist by qualification and a Network Enthusiast by interest. I developed interest in networking being in the company of a passionate Network Professional, my husband.

I am a strong believer of the fact that “learning is a constant process of discovering yourself.”
– Rashmi Bhardwaj (Author/Editor)