防火墙上的object-group命令实际应用

amao314688

                        使用object-group 能大大简化配置工作量，很实用。
防火墙上的配置：
object-group service gjlyd tcp
  description used for hai nai guo ji lv you daoserver
  port-object eq 445
  port-object eq ftp
  port-object eq 3389
  port-object eq www
  port-object eq 8080
  port-object eq 1433
object-group network gjlydser
  network-object host 10.9.2.66
  network-object host 10.9.2.67
  network-object host 10.9.2.68
access-list inside permit tcp host 10.2.57.67 object-groupgjlydser object-group gjlyd
access-list inside permit tcp host 10.2.57.151 object-groupgjlydser object-group gjlyd

输出：（看着很爽）

access-list inside line 494 permit tcp host 10.2.57.67object-group gjlydser object-group gjlyd
access-list inside line 494 permit tcp host 10.2.57.67 host10.9.2.66 eq 445 (hitcnt=0)
access-list inside line 494 permit tcp host 10.2.57.67 host10.9.2.66 eq ftp (hitcnt=0)
access-list inside line 494 permit tcp host 10.2.57.67 host10.9.2.66 eq 3389 (hitcnt=0)
access-list inside line 494 permit tcp host 10.2.57.67 host10.9.2.66 eq www (hitcnt=0)
access-list inside line 494 permit tcp host 10.2.57.67 host10.9.2.66 eq 8080 (hitcnt=0)
access-list inside line 494 permit tcp host 10.2.57.67 host10.9.2.66 eq 1433 (hitcnt=0)
access-list inside line 494 permit tcp host 10.2.57.67 host10.9.2.67 eq 445 (hitcnt=0)
access-list inside line 494 permit tcp host 10.2.57.67 host10.9.2.67 eq ftp (hitcnt=0)
access-list inside line 494 permit tcp host 10.2.57.67 host10.9.2.67 eq 3389 (hitcnt=0)
access-list inside line 494 permit tcp host 10.2.57.67 host10.9.2.67 eq www (hitcnt=0)
access-list inside line 494 permit tcp host 10.2.57.67 host10.9.2.67 eq 8080 (hitcnt=0)
access-list inside line 494 permit tcp host 10.2.57.67 host10.9.2.67 eq 1433 (hitcnt=0)
access-list inside line 494 permit tcp host 10.2.57.67 host10.9.2.68 eq 445 (hitcnt=0)
access-list inside line 494 permit tcp host 10.2.57.67 host10.9.2.68 eq ftp (hitcnt=0)
access-list inside line 494 permit tcp host 10.2.57.67 host10.9.2.68 eq 3389 (hitcnt=0)
access-list inside line 494 permit tcp host 10.2.57.67 host10.9.2.68 eq www (hitcnt=0)
access-list inside line 494 permit tcp host 10.2.57.67 host10.9.2.68 eq 8080 (hitcnt=0)
access-list inside line 494 permit tcp host 10.2.57.67 host10.9.2.68 eq 1433 (hitcnt=0)
access-list inside line 495 permit tcp host 10.2.57.151object-group gjlydser object-group gjlyd
access-list inside line 495 permit tcp host 10.2.57.151 host10.9.2.66 eq 445 (hitcnt=0)
access-list inside line 495 permit tcp host 10.2.57.151 host10.9.2.66 eq ftp (hitcnt=0)
access-list inside line 495 permit tcp host 10.2.57.151 host10.9.2.66 eq 3389 (hitcnt=0)
access-list inside line 495 permit tcp host 10.2.57.151 host10.9.2.66 eq www (hitcnt=0)
access-list inside line 495 permit tcp host 10.2.57.151 host10.9.2.66 eq 8080 (hitcnt=0)
access-list inside line 495 permit tcp host 10.2.57.151 host10.9.2.66 eq 1433 (hitcnt=0)
access-list inside line 495 permit tcp host 10.2.57.151 host10.9.2.67 eq 445 (hitcnt=0)
access-list inside line 495 permit tcp host 10.2.57.151 host10.9.2.67 eq ftp (hitcnt=0)
access-list inside line 495 permit tcp host 10.2.57.151 host10.9.2.67 eq 3389 (hitcnt=0)
access-list inside line 495 permit tcp host 10.2.57.151 host10.9.2.67 eq www (hitcnt=0)
access-list inside line 495 permit tcp host 10.2.57.151 host10.9.2.67 eq 8080 (hitcnt=0)
access-list inside line 495 permit tcp host 10.2.57.151 host10.9.2.67 eq 1433 (hitcnt=0)
access-list inside line 495 permit tcp host 10.2.57.151 host10.9.2.68 eq 445 (hitcnt=0)
access-list inside line 495 permit tcp host 10.2.57.151 host10.9.2.68 eq ftp (hitcnt=0)
access-list inside line 495 permit tcp host 10.2.57.151 host10.9.2.68 eq 3389 (hitcnt=0)
access-list inside line 495 permit tcp host 10.2.57.151 host10.9.2.68 eq www (hitcnt=0)
access-list inside line 495 permit tcp host 10.2.57.151 host10.9.2.68 eq 8080 (hitcnt=0)
access-list inside line 495 permit tcp host 10.2.57.151 host10.9.2.68 eq 1433 (hitcnt=0)


参考：http://blog.sina.com.cn/s/blog_59879e3a0100o5w1.html

Object-Group     ASA的Object Group可以将具有相同特性的对象组织起来，这样可以减少ACE的配置的条目，进而减少配置，便于管理。
            
            Object groups can be thought of as a type of macro used within access lists. You can define several different types of object groups, each containing a list of similar values, as follows:（ Object Grou的类型有：）
            Network object group Contains one or more IP addresses
            ICMP object group Contains one or more ICMP types
            Protocol object group Contains one or more IP protocols
            Service object group Contains one or more UDP or TCP port numbers
            
                 在创建Object Group以后，可以在一个ACE中调用，这样可以将ACE的条目缩小为1个；同时，你也可以将一个Object Group嵌套到另外一个Object Group中
            
                 语法：
                  
            object-group {{protocol | network | icmp-type} grp_id | service grp_id {tcp | udp | tcp-udp}}
            object-group ——定义一个对象组
            protocol —— 指定IP协议（协议类型1到254），或名称标识，比如TCP、UDP、ICMP、GRP和IGMP；如果想包含所有的IP协议，可以使用关键字IP
            network —— 指定host，subnet或网络地址；
            icmp-type —— 指定ICMP类型，比如echo、echo-reply已经traceroute；
            
            grp_id —— 自动4层TCP和UDP协议的端口号；
            tcp —— 指定一组TCP服务，比如HTTP，FTP，Telnet和SMTP等
            udp —— 指定一组UDP服务，比如DNS，TFTP和ISAKMP等
            tcp-udp —— 指定一组即使用TCP又使用UDP的服务，比如DNS和Kerberos等
            
            
            
            例：
            Firewall(config)# access-list anti_spoof deny ip 10.0.0.0 255.0.0.0 any
            Firewall(config)# access-list anti_spoof deny ip 172.16.0.0 255.240.0.0 any
            Firewall(config)# access-list anti_spoof deny ip 192.168.0.0 255.255.0.0 any
            This could also be configured by referencing a network object group, which would simplify the access list:
            Firewall(config)# object-group network rfc1918
            Firewall(config-network)# network-object 10.0.0.0 255.0.0.0
            Firewall(config-network)# network-object 172.16.0.0 255.240.0.0
            Firewall(config-network)# network-object 192.168.0.0 255.255.0.0
            Firewall(config-network)# exit
            Firewall(config)# access-list anti_spoof deny ip object-group rfc1918 any



                                                                        

幸福的海

庄歪

谢谢分享

sunshine0931

wx592176094wx