Objects for Access Control

Objects are reusable components for use in your configuration. You can define and use them in Cisco ASA configurations in the place of inline IP addresses, services, names, and so on. Objects make it easy to maintain your configurations because you can modify an object in one place and have it be reflected in all other places that are referencing it. Without objects you would have to modify the parameters for every feature when required, instead of just once. For example, if a network object defines an IP address and subnet mask, and you want to change the address, you only need to change it in the object definition, not in every feature that refers to that IP address.

Guidelines for Objects

IPv6 Guidelines

Supports IPv6 with the following restrictions:

  • You can mix IPv4 and IPv6 entries in a network object group, but you cannot use a mixed object group for NAT.

Additional Guidelines and Limitations

  • Objects must have unique names, because objects and object groups share the same name space. While you might want to create a network object group named “Engineering” and a service object group named “Engineering,” you need to add an identifier (or “tag”) to the end of at least one object group name to make it unique. For example, you can use the names “Engineering_admins” and “Engineering_hosts” to make the object group names unique and to aid in identification.

  • If you enter more than one item in source or destination address, or source or destination service, in an ACL or access rule, ASDM automatically creates an object group for them with the prefix DM_INLINE. These objects are not shown on the objects page, but they are defined on the device.

  • Object names are limited to 64 characters, including letters, numbers, and these characters: .!@#$%^&()-_{}. Object names are case-sensitive.

  • You cannot remove an object or make an object empty if it is used in a command, unless you enable forward referencing (in the access rules advanced settings).

Configure Objects

The following sections describe how to configure objects that are primarily used on access control.

Configure Network Objects and Groups

Network objects and groups identify IP addresses or host names. Use these objects in access control lists to simplify your rules.

Configure a Network Object

A network object can contain a host, a network IP address, a range of IP addresses, or a fully qualified domain name (FQDN).

You can also enable NAT rules on the object (excepting FQDN objects). For more information about configuring object NAT, see Network Address Translation (NAT).

Procedure
Step 1

Choose Configuration > Firewall > Objects > Network Objects/Group.

Step 2

Do one of the following:

  • Choose Add > Network Object to add a new object. Enter a name and optionally, a description.

  • Choose an existing object and click Edit.

Step 3

Configure the address for the object based on the object Type and IP version fields.

  • Host—The IPv4 or IPv6 address of a single host. For example, 10.1.1.1 or 2001:DB8::0DB8:800:200C:417A.

  • Network—The address of a network. For IPv4, include the mask, for example, IP address = 10.0.0.0 Netmask = 255.0.0.0. For IPv6, include the prefix, such as IP Address = 2001:DB8:0:CD30:: Prefix Length = 60.

  • Range—A range of addresses. You can specify IPv4 or IPv6 ranges. Do not include masks or prefixes.

  • FQDN—A fully-qualified domain name, that is, the name of a host, such as www.example.com.

Step 4

Click OK, then click Apply.

You can now use this network object when you create a rule. If you edit an object, the change is inherited automatically by any rules using the object.

Configure a Network Object Group

Network object groups can contain multiple network objects as well as inline networks or hosts. Network object groups can include a mix of both IPv4 and IPv6 addresses.

However, you cannot use a mixed IPv4 and IPv6 object group for NAT, or object groups that include FQDN objects.

Procedure
Step 1

Choose Configuration > Firewall > Objects > Network Objects/Groups.

Step 2

Do one of the following:

  • Choose Add > Network Object Group to add a new object. Enter a name and optionally, a description.

  • Choose an existing object and click Edit.

Step 3

Add network objects to the group using any combination of the following techniques:

  • Existing Network Objects/Groups—Select any already defined network object or group and click Add to include them in the group.

  • Create New Network Object Member—Enter the criteria for a new network object and click Add. If you give the object a name, when you apply changes, the new object is created and added to the group. The name is optional when adding hosts or networks.

Step 4

After you add all the member objects, click OK, then click Apply.

You can now use this network object group when you create a rule. For an edited object group, the change is inherited automatically by any rules using the group.

Configure Service Objects and Service Groups

Service objects and groups identify protocols and ports. Use these objects in access control lists to simplify your rules.

Configure a Service Object

A service object can contain a single protocol specification.

Procedure
Step 1

Choose Configuration > Firewall > Objects > Service Object/Group.

Step 2

Do one of the following:

  • Choose Add > Service Object to add a new object. Enter a name and optionally, a description.

  • Choose an existing object and click Edit.

Step 3

Choose the service type and fill in details as needed:

  • Protocol—A number between 0-255, or a well-known name, such as ip, tcp, udp, gre, and so forth..

  • ICMP, ICMP6—You can leave the message type and code fields blank to match any ICMP/ICMP version 6 message. You can optionally specify the ICMP type by name or number (0-255) to limit the object to that message type. If you specify a type, you can optionally specify an ICMP code for that type (1-255). If you do not specify the code, then all codes are used.

  • TCP, UDP, SCTP—You can optionally specify ports for the source, destination, or both. You can specify the port by name or number. You can include the following operators:

    • <—Less than. For example, <80.

    • >—Greater than. For example, >80.

    • !=—Not equal to. For example, !=80.

    • - (hyphen)—An inclusive range of values. For example, 100-200.

Step 4

Click OK, and then Apply.

Configure a Service Group

A service object group includes a mix of protocols, if desired, including optional source and destination ports for protocols that use them, and ICMP type and code.

Before you begin

You can model all services using the generic service object group, which is explained here. However, you can still configure the types of service group objects that were available prior to ASA 8.3(1). These legacy objects include TCP/UDP/TCP-UDP port groups, protocol groups, and ICMP groups. The contents of these groups are equivalent to the associated configuration in the generic service object group, with the exception of ICMP groups, which do not support ICMP6 or ICMP codes. If you still want to use these legacy objects, for detailed instructions, see the object-service command description in the command reference on Cisco.com.

Procedure
Step 1

Choose Configuration > Firewall > Objects > Service Objects/Groups.

Step 2

Do one of the following:

  • Choose Add > Service Group to add a new object. Enter a name and optionally, a description.

  • Choose an existing object and click Edit.

Step 3

Add service objects to the group using any combination of the following techniques:

  • Existing Service/Service Group—Select any already defined service, service object, or group and click Add to include them in the group.

  • Create New Member—Enter the criteria for a new service object and click Add. If you give the object a name, when you apply changes, the new object is created and added to the group; otherwise, unnamed objects are members of this group only. You cannot name TCP-UDP objects; these are members of the group only.

Step 4

After you add all the member objects, click OK, then click Apply.

You can now use this service object group when you create a rule. For an edited object group, the change is inherited automatically by any rules using the group.

Configure Local User Groups

You can create local user groups for use in features that support the identity firewall by including the group in an extended ACL, which in turn can be used in an access rule, for example.

The ASA sends an LDAP query to the Active Directory server for user groups globally defined in the Active Directory domain controller. The ASA imports these groups for identity-based rules. However, the ASA might have localized network resources that are not defined globally that require local user groups with localized security policies. Local user groups can contain nested groups and user groups that are imported from Active Directory. The ASA consolidates local and Active Directory groups.

A user can belong to local user groups and user groups imported from Active Directory.

Because you can use usernames and user group names directly in an ACL, you need to configure local user groups only if:

  • You want to create a group of users defined in the LOCAL database.

  • You want to create a group of users or user groups that are not captured in a single user group defined on the AD server.

Procedure

Step 1

Choose Configuration > Firewall > Objects > Local User Groups.

Step 2

Do one of the following:

  • Choose Add to add a new object. Enter a name and optionally, a description.

  • Choose an existing object and click Edit.

Step 3

Add users or groups to the object using any of these methods:

  • Select existing users or groups—Select the domain that contains the user or group, then pick the user or group name from the lists and click Add. For long lists, use the Find box to help locate the user. The names are pulled from the server for the selected domain.

  • Manually type user names—You can simply type in the user or group names in the bottom edit box and click Add. When using this method, the selected domain name is ignored, and the default domain is used if you do not specify one. For users, the format is domain_name\username; for groups, there is a double \\, domain_name\\group_name.

Step 4

After you add all the member objects, click OK, then click Apply.

You can now use this user object group when you create a rule. For an edited object group, the change is inherited automatically by any rules using the group.

Configure Security Group Object Groups

You can create security group object groups for use in features that support Cisco TrustSec by including the group in an extended ACL, which in turn can be used in an access rule, for example.

When integrated with Cisco TrustSec, the ASA downloads security group information from the ISE. The ISE acts as an identity repository, by providing Cisco TrustSec tag-to-user identity mapping and Cisco TrustSec tag-to-server resource mapping. You provision and manage security group ACLs centrally on the ISE.

However, the ASA might have localized network resources that are not defined globally that require local security groups with localized security policies. Local security groups can contain nested security groups that are downloaded from the ISE. The ASA consolidates local and central security groups.

To create local security groups on the ASA, you create a local security object group. A local security object group can contain one or more nested security object groups or Security IDs or security group names. You can also create a new Security ID or security group name that does not exist on the ASA.

You can use the security object groups you create on the ASA to control access to network resources. You can use the security object group as part of an access group or service policy.


Tip

If you create a group with tags or names that are not known to the ASA, any rules that use the group will be inactive until the tags or names are resolved with ISE.

Procedure

Step 1

Choose Configuration > Firewall > Objects > Security Group Object Groups.

Step 2

Do one of the following:

  • Choose Add to add a new object. Enter a name and optionally, a description.

  • Choose an existing object and click Edit.

Step 3

Add security groups to the object using any of these methods:

  • Select existing local security group object groups—Pick from the list of objects already defined and click Add. For long lists, use the Find box to help locate the object.

  • Select security groups discovered from ISE—Pick groups from the list of existing groups and click Add.

  • Manually add security tags or names—You can simply type in the tag number or security group name in the bottom edit box and click Add. A tag is a number from 1 to 65533 and is assigned to a device through IEEE 802.1X authentication, web authentication, or MAC authentication bypass (MAB) by the ISE. Security group names are created on the ISE and provide user-friendly names for security groups. The security group table maps SGTs to security group names. Consult your ISE configuration for the valid tags and names.

Step 4

After you add all the member objects, click OK, then click Apply.

You can now use this security group object group when you create a rule. For an edited object group, the change is inherited automatically by any rules using the group.

Configure Time Ranges

A time range object defines a specific time consisting of a start time, an end time, and optional recurring entries. You use these objects on ACL rules to provide time-based access to certain features or assets. For example, you could create an access rule that allows access to a particular server during working hours only.


Note

You can include multiple periodic entries in a time range object. If a time range has both absolute and periodic values specified, then the periodic values are evaluated only after the absolute start time is reached, and they are not further evaluated after the absolute end time is reached.

Creating a time range does not restrict access to the device. This procedure defines the time range only. You must then use the object in an access control rule.

Procedure

Step 1

Choose Configuration  > Firewall > Objects  > Time Ranges.

Step 2

Do one of the following:

  • Choose Add to add a new time range. Enter a name and optionally, a description.

  • Choose an existing time range and click Edit.

Step 3

Choose the overall start and end time.

The default is to start now and never end, but you can set specific dates and times. The time range is inclusive of the times that you enter.

Step 4

(Optional) Configure recurring periods within the overall active time, such as the days of the week or the recurring weekly interval in which the time range will be active.

  1. Click Add, or select an existing period and click Edit.

  2. Do one of the following:

    • Click Specify days of the week and times on which this recurring range will be active, and choose the days and times from the lists.

    • Click Specify a weekly interval when this recurring range will be active, and choose the days and times from the lists.

  3. Click OK.

Step 5

Click OK, and then click Apply.

Monitoring Objects

For network, service, and security group objects, you can analyze the usage of an individual object. From their page in the Configuration > Firewall > Objects folder, click the Where Used button.

For network objects, you can also click the Not Used button to find objects that are not used in any rules or other objects. This display gives you a short-cut for deleting these unused objects.

History for Objects

Feature Name

Platform

Releases

Description

Object groups

7.0(1)

Object groups simplify ACL creation and maintenance.

Regular expressions and policy maps

7.2(1)

Regular expressions and policy maps were introduced to be used under inspection policy maps. The following commands were introduced: class-map type regex, regex, match regex.

Objects

8.3(1)

Object support was introduced.

User Object Groups for Identity Firewall

8.4(2)

User object groups for identity firewall were introduced.

Security Group Object Groups for Cisco TrustSec

8.4(2)

Security group object groups for Cisco TrustSec were introduced.

Mixed IPv4 and IPv6 network object groups

9.0(1)

Previously, network object groups could only contain all IPv4 addresses or all IPv6 addresses. Now network object groups can support a mix of both IPv4 and IPv6 addresses.

Note 

You cannot use a mixed object group for NAT.

Extended ACL and object enhancement to filter ICMP traffic by ICMP code

9.0(1)

ICMP traffic can now be permitted/denied based on ICMP code.

We introduced or modified the following screens:

Configuration > Firewall > Objects > Service Objects/Groups, 
Configuration > Firewall > Access Rule

Service object support for Stream Control Transmission Protocol (SCTP)

9.5(2)

You can now create service objects and groups that specific SCTP ports.

We modified the add/edit dialog boxes for service objects and groups on the Configuration > Firewall > Objects > Service Objects/Groups page.