Cisco Cisco ASA Series User manual

Cisco Systems, Inc.
www.cisco.com
Cisco has more than 200 offices worldwide.
Addresses, phone numbers, and fax numbers
are listed on the Cisco website at
www.cisco.com/go/offices.
Cisco ASA Series Firewall CLI
Configuration Guide
Software Version 9.4
For the ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5512-X,
ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, ASA 5555-X,
ASA 5585-X, ASA Services Module, and the
Adaptive Security Virtual Appliance
First Published: March 23, 2015
Last Updated: April 7, 2015
Text Part Number: N/A, Online only

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT
TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS
MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY
PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this
URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display
output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in
illustrative content is unintentional and coincidental.
Cisco ASA Series Firewall CLI Configuration Guide
Copyright © 2015 Cisco Systems, Inc. All rights reserved.

iii
Cisco ASA Series Firewall CLI Configuration Guide
About This Guide
•Document Objectives, page iii
•Related Documentation, page iii
•Conventions, page iii
•Obtaining Documentation and Submitting a Service Request, page iv
Document Objectives
The purpose of this guide is to help you configure the firewall features for Cisco ASA series using the
command-line interface. This guide does not cover every feature, but describes only the most common
configuration scenarios.
You can also configure and monitor the ASA by using the Adaptive Security Device Manager (ASDM),
a web-based GUI application. ASDM includes configuration wizards to guide you through some
common configuration scenarios, and online help for less common scenarios.
Throughout this guide, the term “ASA” applies generically to supported models, unless specified
otherwise.
Related Documentation
For more information, see Navigating the Cisco ASA Series Documentation at
http://www.cisco.com/go/asadocs.
Conventions
This document uses the following conventions:
Convention Indication
bold font Commands and keywords and user-entered text appear in bold font.
italic font Document titles, new or emphasized terms, and arguments for which you supply
values are in italic font.
[ ] Elements in square brackets are optional.

iv
Cisco ASA Series Firewall CLI Configuration Guide
Note Means reader take note.
Tip Means the following information will help you solve a problem.
Caution Means reader be careful. In this situation, you might perform an action that could result in equipment
damage or loss of data.
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a
service request, and gathering additional information, see What’s New in Cisco Product Documentation
at: http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html.
Subscribe to What’s New in Cisco Product Documentation, which lists all new and revised Cisco technical
documentation, as an RSS feed and deliver content directly to your desktop using a reader application. The
RSS feeds are a free service.
{x | y | z } Required alternative keywords are grouped in braces and separated by
vertical bars.
[ x | y | z ] Optional alternative keywords are grouped in brackets and separated by
vertical bars.
string A nonquoted set of characters. Do not use quotation marks around the string or
the string will include the quotation marks.
courier font Terminal sessions and information the system displays appear in courier font.
courier bold font Commands and keywords and user-entered text appear in bold courier font.
courier italic font Arguments for which you supply values are in courier italic font.
< > Nonprinting characters such as passwords are in angle brackets.
[ ] Default responses to system prompts are in square brackets.
!, # An exclamation point (!) or a pound sign (#) at the beginning of a line of code
indicates a comment line.

CHAPTER
1-1
Cisco ASA Series Firewall CLI Configuration Guide
1
Introduction to Cisco ASA Firewall Services
First Published: March 23, 2015
Last Updated: April 7, 2015
Firewall services are those ASA features that are focused on controlling access to the network, including
services that block traffic and services that enable traffic flow between internal and external networks.
These services include those that protect the network against threats, such as Denial of Service (DoS)
and other attacks.
The following topics provide an overview of firewall services.
•How to Implement Firewall Services, page 1-1
•Basic Access Control, page 1-2
•Application Filtering, page 1-2
•URL Filtering, page 1-3
•Threat Protection, page 1-3
•Network Address Translation, page 1-4
•Application Inspection, page 1-5
•Use Case: Expose a Server to the Public, page 1-5
How to Implement Firewall Services
The following procedure provides a general sequence for implementing firewall services. However, each
step is optional, needed only if you want to provide the service to your network.
Before You Begin
Configure the ASA according to the general operations configuration guide, including at minimum basic
settings, interface configuration, routing, and management access.
Procedure
Step 1 Implement access control for the network. See Basic Access Control, page 1-2.
Step 2 Implement application filtering. See Application Filtering, page 1-2.
Step 3 Implement URL filtering. See URL Filtering, page 1-3.
Step 4 Implement threat protection. See Threat Protection, page 1-3.

1-2
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 1
Basic Access Control
Step 5 Implement Network Address Translation (NAT). See Network Address Translation, page 1-4.
Step 6 Implement application inspection if the default settings are insufficient for your network. See
Application Inspection, page 1-5.
Basic Access Control
Access rules, applied per interface or globally, are your first line of defense. You can drop, upon entry,
specific types of traffic, or traffic from (or to) specific hosts or networks. By default, the ASA allows
traffic to flow freely from an inside network (higher security level) to an outside network (lower security
level).
You can apply an access rule to limit traffic from inside to outside, or allow traffic from outside to inside.
Basic access rules control traffic using a “5-tuple” of source address and port, destination address and
port, and protocol.
You can augment your rules by making them identity aware. This lets you configure rules based on user
identity or group membership. To implement identity control, do any combination of the following:
•Install Cisco Context Directory Agent (CDA), also known as AD agent, on a separate server to
collect user and group information already defined in your Active Directory (AD) server. Then,
configure the ASA to get this information, and add user or group criteria to your access rules.
•Install Cisco Identity Services Engine (ISE) on a separate server to implement Cisco Trustsec. You
can then add security group criteria to your access rules.
•Install the ASA FirePOWER module on the ASA and implement identity policies in the module. The
identity-aware access policies in ASA FirePOWER would apply to any traffic that you redirect to
the module.
Related Topics
•Access Control Lists, page 3-1
•Access Rules, page 4-1
•Identity Firewall, page 5-1
•ASA and Cisco TrustSec, page 6-1
•ASA FirePOWER Module, page 7-1
Application Filtering
The wide-spread use of web-based applications means that a lot of traffic runs over the HTTP or HTTPS
protocols. With traditional 5-tuple access rules, you either allow or disallow all HTTP/HTTPS traffic.
You might require more granular control of web traffic.
You can install a module on the ASA to provide application filtering to selectively allow HTTP or other
traffic based on the application being used. Thus, you do not have to make a blanket permit for HTTP.
You can look inside the traffic and prevent applications that are unacceptable for your network (for
example, inappropriate file sharing). When you add a module for application filtering, do not configure
HTTP inspection on the ASA.

1-3
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 1
URL Filtering
To implement application filtering, install the ASA FirePOWER module on the ASA and use application
filtering criteria in your ASA FirePOWER access rules. These policies apply to any traffic that you
redirect to the module.
Related Topics
•ASA FirePOWER Module, page 7-1
URL Filtering
URL filtering denies or allows traffic based on the URL of the destination site.
The purpose of URL filtering is primarily to completely block or allow access to a web site. Although
you can target individual pages, you typically specify a host name (such as www.example.com) or a URL
category, which defines a list of host names that provide a particular type of service (such as Gambling).
When trying to decide whether to use URL filtering or application filtering for HTTP/HTTPS traffic,
consider whether your intention is to create a policy that applies to all traffic directed at a web site. If
your intention is to treat all such traffic the same way (denying it or allowing it), use URL filtering. If
your intention is to selectively block or allow traffic to the site, use application filtering.
To implement URL filtering, do one of the following:
•Subscribe to the Cloud Web Security service, where you configure your filtering policies in
ScanCenter, and then configure the ASA to send traffic to your Cloud Web Security account.
•Install the ASA FirePOWER module on the ASA and use URL filtering criteria in your ASA
FirePOWER access rules. These policies apply to any traffic that you redirect to the module.
Related Topics
•ASA and Cisco Cloud Web Security, page 8-1
•ASA FirePOWER Module, page 7-1
Threat Protection
You can implement a number of measures to protect against scanning, denial of service (DoS), and other
attacks. A number of ASA features help protect against attacks by applying connection limits and
dropping abnormal TCP packets. Some features are automatic, others are configurable but have defaults
appropriate in most cases, while others are completely optional and you must configure them if you want
them.
Following are the threat protection services available with the ASA.
•IP packet fragmentation protection—The ASA performs full reassembly of all ICMP error messages
and virtual reassembly of the remaining IP fragments that are routed through the ASA, and drops
fragments that fail the security check. No configuration is necessary.
•Connection limits, TCP normalization, and other connection-related features—Configure
connection-related services such as TCP and UDP connection limits and timeouts, TCP sequence
number randomization, TCP normalization, and TCP state bypass. TCP normalization is designed
to drop packets that do not appear normal.

1-4
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 1
Network Address Translation
For example, you can limit TCP and UDP connections and embryonic connections (a connection
request that has not finished the necessary handshake between source and destination). Limiting the
number of connections and embryonic connections protects you from a DoS attack. The ASA uses
the embryonic limit to trigger TCP Intercept, which protects inside systems from a DoS attack
perpetrated by flooding an interface with TCP SYN packets.
•Threat detection—Implement threat detection on the ASA to collect statistics to help identify
attacks. Basic threat detection is enabled by default, but you can implement advanced statistics and
scanning threat detection. You can shun hosts that are identified as a scanning threat.
•Next-Generation IPS—Install the ASA FirePOWER module on the ASA and implement Next
Generation IPS intrusion rules in your ASA FirePOWER. These policies would apply to any traffic
that you redirect to ASA FirePOWER.
Related Topics
•Connection Settings, page 16-1
•Threat Detection, page 18-1
•ASA FirePOWER Module, page 7-1
Network Address Translation
One of the main functions of Network Address Translation (NAT) is to enable private IP networks to
connect to the Internet. NAT replaces a private IP address with a public IP address, translating the private
addresses in the internal private network into legal, routable addresses that can be used on the public
Internet. In this way, NAT conserves public addresses because you can advertise at a minimum only one
public address for the entire network to the outside world.
Other functions of NAT include:
•Security—Keeping internal IP addresses hidden discourages direct attacks.
•IP routing solutions—Overlapping IP addresses are not a problem when you use NAT.
•Flexibility—You can change internal IP addressing schemes without affecting the public addresses
available externally; for example, for a server accessible to the Internet, you can maintain a fixed IP
address for Internet use, but internally, you can change the server address.
•Translating between IPv4 and IPv6 (Routed mode only)—If you want to connect an IPv6 network
to an IPv4 network, NAT lets you translate between the two types of addresses.
NAT is not required. If you do not configure NAT for a given set of traffic, that traffic will not be
translated, but will have all of the security policies applied as normal.
Related Topics
•Network Address Translation (NAT), page 9-1
•NAT Examples and Reference, page 10-1

1-5
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 1
Application Inspection
Application Inspection
Application inspection engines are required for services that embed IP addressing information in the user
data packet or that open secondary channels on dynamically assigned ports. These protocols require the
ASA to do a deep packet inspection, to open the required pinholes and to apply network address
translation (NAT).
The default ASA policy already applies inspection globally for many popular protocols, such as DNS,
FTP, SIP, ESMTP, TFTP, and others. The default inspections might be all you require for your network.
However, you might need to enable inspection for other protocols, or fine-tune an inspection. Many
inspections include detailed options that let you control packets based on their contents. If you know a
protocol well, you can apply fine-grained control on that traffic.
You use service policies to configure application inspection. You can configure a global service policy,
or apply a service policy to each interface, or both.
Related Topics
•Service Policy Using the Modular Policy Framework, page 11-1
•Getting Started with Application Layer Protocol Inspection, page 12-1
•Inspection of Basic Internet Protocols, page 13-1
•Inspection for Voice and Video Protocols, page 14-1
•Inspection of Database, Directory, and Management Protocols, page 15-1
Use Case: Expose a Server to the Public
You can make certain application services on a server available to the public. For example, you could
expose a web server, so that users can connect to the web pages but not make any other connections to
the server.
To expose a server to the public, you typically need to create access rules that allow the connection and
NAT rules to translate between the server’s internal IP address and an external address that the public
can use. In addition, you can use port address translation (PAT) to map an internal port to an external
port, if you do not want the externally exposed service to use the same port as the internal server. For
example, if the internal web server is not running on TCP/80, you can map it to TCP/80 to make
connections easier for external users.
The following example makes a web server on the inside private network available for public access.

1-6
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 1
Use Case: Expose a Server to the Public
Figure 1-1 Static NAT for an Inside Web Server
Procedure
Step 1 Create a network object for the internal web server.
hostname(config)# object network myWebServ
hostname(config-network-object)# host 10.1.2.27
Step 2 Configure static NAT for the object:
hostname(config-network-object)# nat (inside,outside) static 209.165.201.10
Step 3 Add an access rule to the access group attached to the outside interface to permit web access to the
server.
hostname(config)# access-list outside_access_in line 1 extended permit tcp any4 object
myWebServ eq http
Step 4 If you do not already have an access group on the outside interface, apply it using the access-group
command:
hostname(config)# access-group outside_access_in in interface outside
Related Topics
•Static NAT, page 9-27
Outside
Inside
10.1.2.1
209.165.201.1
Security
Appliance
myWebServ
10.1.2.27
209.165.201.12
10.1.2.27 209.165.201.10
248772
Undo Translation

P ART 1
Access Control

CHAPTER
2-1
Cisco ASA Series Firewall CLI Configuration Guide
2
Objects for Access Control
Objects are reusable components for use in your configuration. You can define and use them in Cisco
ASA configurations in the place of inline IP addresses, services, names, and so on. Objects make it easy
to maintain your configurations because you can modify an object in one place and have it be reflected
in all other places that are referencing it. Without objects you would have to modify the parameters for
every feature when required, instead of just once. For example, if a network object defines an IP address
and subnet mask, and you want to change the address, you only need to change it in the object definition,
not in every feature that refers to that IP address.
•Guidelines for Objects, page 2-1
•Configure Objects, page 2-2
•Monitoring Objects, page 2-10
•History for Objects, page 2-11
Guidelines for Objects
IPv6 Guidelines
Supports IPv6 with the following restrictions:
•The ASA does not support IPv6 nested network object groups, so you cannot group an object with
IPv6 entries under another IPv6 object group.
•You can mix IPv4 and IPv6 entries in a network object group; you cannot use a mixed object group
for NAT.
Additional Guidelines and Limitations
•Objects must have unique names, because objects and object groups share the same name space.
While you might want to create a network object group named “Engineering” and a service object
group named “Engineering,” you need to add an identifier (or “tag”) to the end of at least one object
group name to make it unique. For example, you can use the names “Engineering_admins” and
“Engineering_hosts” to make the object group names unique and to aid in identification.
•Object names are limited to 64 characters, including letters, numbers, and these characters:
.!@#$%^&()-_{}. Object names are case-sensitive.
•You cannot remove an object or make an object empty if it is used in a command, unless you enable
forward referencing (the forward-reference enable command).

2-2
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 2 Objects for Access Control
Configure Objects
Configure Objects
The following sections describe how to configure objects that are primarily used on access control.
•Configure Network Objects and Groups, page 2-2
•Configure Service Objects and Service Groups, page 2-4
•Configure Local User Groups, page 2-7
•Configure Security Group Object Groups, page 2-8
•Configure Time Ranges, page 2-9
Configure Network Objects and Groups
Network objects and groups identify IP addresses or host names. Use these objects in access control lists
to simplify your rules.
•Configure a Network Object, page 2-2
•Configure a Network Object Group, page 2-3
Configure a Network Object
A network object can contain a host, a network IP address, a range of IP addresses, or a fully qualified
domain name (FQDN).
You can also enable NAT rules on the object (excepting FQDN objects). See the firewall configuration
guide for more information about configuring object NAT.
Procedure
Step 1 Create or edit a network object using the object name.
hostname(config)# object network object_name
Example
hostname(config)# object network email-server
Step 2 Add an address to the object using one of the following commands. Use the no form of the command to
remove the object.
•host {IPv4_address | IPv6_address}—The IPv4 or IPv6 address of a single host. For example,
10.1.1.1 or 2001:DB8::0DB8:800:200C:417A.
•subnet {IPv4_address IPv4_mask | IPv6_address/IPv6_prefix}—The address of a network. For
IPv4 subnets, include the mask after a space, for example, 10.0.0.0 255.0.0.0. For IPv6, include the
address and prefix as a single unit (no spaces), such as 2001:DB8:0:CD30::/60.
•range start_address end_address—A range of addresses. You can specify IPv4 or IPv6 ranges. Do
not include masks or prefixes.
•fqdn [v4 | v6] fully_qualified_domain_name—A fully-qualified domain name, that is, the name of
a host, such as www.example.com. Specify v4 to limit the address to IPv4, and v6 for IPv6. If you
do not specify an address type, IPv4 is assumed.
Example

2-3
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 2 Objects for Access Control
Configure Objects
hostname(config-network-object)# host 10.2.2.2
Step 3 (Optional) Add a description.
hostname(config-network-object)# description string
Configure a Network Object Group
Network object groups can contain multiple network objects as well as inline networks or hosts. Network
object groups can include a mix of both IPv4 and IPv6 addresses.
However, you cannot use a mixed IPv4 and IPv6 object group for NAT, or object groups that include
FQDN objects.
Procedure
Step 1 Create or edit a network object group using the object name.
ciscoasa(config)# object-group network group_name
Example
hostname(config)# object-group network admin
Step 2 Add objects and addresses to the network object group using one or more of the following commands.
Use the no form of the command to remove an object.
•network-object host {IPv4_address | IPv6_address}—The IPv4 or IPv6 address of a single host.
For example, 10.1.1.1 or 2001:DB8::0DB8:800:200C:417A.
•network-object {IPv4_address IPv4_mask | IPv6_address/IPv6_prefix}—The address of a network
or host. For IPv4 subnets, include the mask after a space, for example, 10.0.0.0 255.0.0.0. For IPv6,
include the address and prefix as a single unit (no spaces), such as 2001:DB8:0:CD30::/60.
•network-object object object_name—The name of an existing network object.
•group-object object_group_name—The name of an existing network object group.
Example
hostname(config-network-object-group)# network-object 10.1.1.0 255.255.255.0
hostname(config-network-object-group)# network-object 2001:db8:0:cd30::/60
hostname(config-network-object-group)# network-object host 10.1.1.1
hostname(config-network-object-group)# network-object host 2001:DB8::0DB8:800:200C:417A
hostname(config-network-object-group)# network-object object existing-object-1
hostname(config-network-object-group)# group-object existing-network-object-group
Step 3 (Optional) Add a description.
hostname(config-network-object-group)# description string
Example
To create a network group that includes the IP addresses of three administrators, enter the following
commands:
hostname (config)# object-group network admins
hostname (config-protocol)# description Administrator Addresses

2-4
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 2 Objects for Access Control
Configure Objects
hostname (config-protocol)# network-object host 10.2.2.4
hostname (config-protocol)# network-object host 10.2.2.78
hostname (config-protocol)# network-object host 10.2.2.34
Create network object groups for privileged users from various departments by entering the following
commands:
hostname (config)# object-group network eng
hostname (config-network)# network-object host 10.1.1.5
hostname (config-network)# network-object host 10.1.1.9
hostname (config-network)# network-object host 10.1.1.89
hostname (config)# object-group network hr
hostname (config-network)# network-object host 10.1.2.8
hostname (config-network)# network-object host 10.1.2.12
hostname (config)# object-group network finance
hostname (config-network)# network-object host 10.1.4.89
hostname (config-network)# network-object host 10.1.4.100
You then nest all three groups together as follows:
hostname (config)# object-group network admin
hostname (config-network)# group-object eng
hostname (config-network)# group-object hr
hostname (config-network)# group-object finance
Configure Service Objects and Service Groups
Service objects and groups identify protocols and ports. Use these objects in access control lists to
simplify your rules.
•Configure a Service Object, page 2-4
•Configure a Service Group, page 2-5
Configure a Service Object
A service object can contain a single protocol, ICMP, ICMPv6, TCP or UDP port or port ranges.
Procedure
Step 1 Create or edit a service object using the object name.
ciscoasa(config)# object service object_name
Example
hostname(config)# object service web
Step 2 Add a service to the object using one of the following commands. Use the no form of the command to
remove an object.
•service protocol—The name or number (0-255) of an IP protocol. Specify ip to apply to all
protocols.

2-5
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 2 Objects for Access Control
Configure Objects
•service {icmp | icmp6} [icmp-type [icmp_code]]—For ICMP or ICMP version 6 messages. You can
optionally specify the ICMP type by name or number (0-255) to limit the object to that message
type. If you specify a type, you can optionally specify an ICMP code for that type (1-255). If you
do not specify the code, then all codes are used.
•service {tcp | udp} [source operator port] [destination operator port]—For TCP or UDP. You can
optionally specify ports for the source, destination, or both. You can specify the port by name or
number. The operator can be one of the following:
– lt—less than.
– gt—greater than.
– eq—equal to.
– neq—not equal to.
– range—an inclusive range of values. When you use this operator, specify two port numbers, for
example, range 100 200.
Example
hostname(config-service-object)# service tcp destination eq http
Step 3 (Optional) Add a description.
hostname(config-service-object)# description string
Configure a Service Group
A service object group includes a mix of protocols, if desired, including optional source and destination
ports for TCP or UDP.
Before You Begin
You can model all services using the generic service object group, which is explained here. However,
you can still configure the types of service group objects that were available prior to ASA 8.3(1). These
legacy objects include TCP/UDP/TCP-UDP port groups, protocol groups, and ICMP groups. The
contents of these groups are equivalent to the associated configuration in the generic service object
group, with the exception of ICMP groups, which do not support ICMP6 or ICMP codes. If you still want
to use these legacy objects, for detailed instructions, see the object-service command description in the
command reference on Cisco.com.
Procedure
Step 1 Create or edit a service object group using the object name.
ciscoasa(config)# object-group service group_name
Example
hostname(config)# object-group service general-services
Step 2 Add objects and services to the service object group using one or more of the following commands. Use
the no form of the command to remove an object.
•service-object protocol—The name or number (0-255) of an IP protocol. Specify ip to apply to all
protocols.

2-6
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 2 Objects for Access Control
Configure Objects
•service-object {icmp | icmp6} [icmp-type [icmp_code]]—For ICMP or ICMP version 6 messages.
You can optionally specify the ICMP type by name or number (0-255) to limit the object to that
message type. If you specify a type, you can optionally specify an ICMP code for that type (1-255).
If you do not specify the code, then all codes are used.
•service-object {tcp | udp | tcp-udp} [source operator port] [destination operator port]—For TCP,
UDP, or both. You can optionally specify ports for the source, destination, or both. You can specify
the port by name or number. The operator can be one of the following:
– lt—less than.
– gt—greater than.
– eq—equal to.
– neq—not equal to.
– range—an inclusive range of values. When you use this operator, specify two port numbers, for
example, range 100 200.
•service-object object object_name—The name of an existing service object.
•group-object object_group_name—The name of an existing service object group.
Example
hostname(config-service-object-group)# service-object ipsec
hostname(config-service-object-group)# service-object tcp destination eq domain
hostname(config-service-object-group)# service-object icmp echo
hostname(config-service-object-group)# service-object object my-service
hostname(config-service-object-group)# group-object Engineering_groups
Step 3 (Optional) Add a description.
hostname(config-service-object-group)# description string
Examples
The following example shows how to add both TCP and UDP services to a service object group:
hostname(config)# object-group service CommonApps
hostname(config-service-object-group)# service-object tcp destination eq ftp
hostname(config-service-object-group)# service-object tcp-udp destination eq www
hostname(config-service-object-group)# service-object tcp destination eq h323
hostname(config-service-object-group)# service-object tcp destination eq https
hostname(config-service-object-group)# service-object udp destination eq ntp
The following example shows how to add multiple service objects to a service object group:
hostname(config)# object service SSH
hostname(config-service-object)# service tcp destination eq ssh
hostname(config)# object service EIGRP
hostname(config-service-object)# service eigrp
hostname(config)# object service HTTPS
hostname(config-service-object)# service tcp source range 1 1024 destination eq https
hostname(config)# object-group service Group1
hostname(config-service-object-group)# service-object object SSH
hostname(config-service-object-group)# service-object object EIGRP
hostname(config-service-object-group)# service-object object HTTPS

2-7
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 2 Objects for Access Control
Configure Objects
Configure Local User Groups
You can create local user groups for use in features that support the identity firewall by including the
group in an extended ACL, which in turn can be used in an access rule, for example.
The ASA sends an LDAP query to the Active Directory server for user groups globally defined in the
Active Directory domain controller. The ASA imports these groups for identity-based rules. However,
the ASA might have localized network resources that are not defined globally that require local user
groups with localized security policies. Local user groups can contain nested groups and user groups that
are imported from Active Directory. The ASA consolidates local and Active Directory groups.
A user can belong to local user groups and user groups imported from Active Directory.
Because you can use usernames and user group names directly in an ACL, you need to configure local
user groups only if:
•You want to create a group of users defined in the LOCAL database.
•You want to create a group of users or user groups that are not captured in a single user group defined
on the AD server.
For information on how to enable the identity firewall, see Chapter 5, “Identity Firewall.”
Procedure
Step 1 Create or edit a user object group using the object name.
hostname(config)# object-group user group_name
Example
hostname(config)# object-group user admins
Step 2 Add users and groups to the user object group using one or more of the following commands. Use the
no form of the command to remove an object.
•user [domain_NETBIOS_name\]username—A username. If there is a space in the domain name or
username, you must enclose the domain name and user name in quotation marks. The domain name
can be LOCAL (for users defined in the local database) or an Active Directory (AD) domain name
as specified in the user-identity domain domain_NetBIOS_name aaa-server
aaa_server_group_tag command. When adding users defined in an AD domain, the user_name must
be the Active Directory sAMAccountName, which is unique, instead of the common name (cn),
which might not be unique. If you do not specify a domain name, the default is used, which is either
LOCAL or the one defined on the user-identity default-domain command.
•user-group [domain_NETBIOS_name\\]username—A user group. If there is a space in the domain
name or group name, you must enclose the domain name and group name in quotation marks. Note
the double \\ that separates the domain and group names.
•group-object object_group_name—The name of an existing user object group.
Example
hostname(config-user-object-group)# user EXAMPLE\admin
hostname(config-user-object-group)# user-group EXAMPLE\\managers
hostname(config-user-object-group)# group-object local-admins
Step 3 (Optional) Add a description.
hostname(config-user-object-group)# description string

2-8
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 2 Objects for Access Control
Configure Objects
Configure Security Group Object Groups
You can create security group object groups for use in features that support Cisco TrustSec by including
the group in an extended ACL, which in turn can be used in an access rule, for example.
When integrated with Cisco TrustSec, the ASA downloads security group information from the ISE. The
ISE acts as an identity repository, by providing Cisco TrustSec tag-to-user identity mapping and Cisco
TrustSec tag-to-server resource mapping. You provision and manage security group ACLs centrally on
the ISE.
However, the ASA might have localized network resources that are not defined globally that require local
security groups with localized security policies. Local security groups can contain nested security
groups that are downloaded from the ISE. The ASA consolidates local and central security groups.
To create local security groups on the ASA, you create a local security object group. A local security
object group can contain one or more nested security object groups or Security IDs or security group
names. You can also create a new Security ID or security group name that does not exist on the ASA.
You can use the security object groups you create on the ASA to control access to network resources.
You can use the security object group as part of an access group or service policy.
For information on how to integrate the ASA with Trustsec, see Chapter 6, “ASA and Cisco TrustSec.”
Tip If you create a group with tags or names that are not known to the ASA, any rules that use the group will
be inactive until the tags or names are resolved with ISE.
Procedure
Step 1 Create or edit a security group object group using the object name.
hostname(config)# object-group security group_name
Example
hostname(config)# object-group security mktg-sg
Step 2 Add objects to the service group object group using one or more of the following commands. Use the no
form of the command to remove an object.
•security-group {tag sgt_number | name sg_name}—A security group tag (SGT) or name. A tag is
a number from 1 to 65533 and is assigned to a device through IEEE 802.1X authentication, web
authentication, or MAC authentication bypass (MAB) by the ISE. Security group names are created
on the ISE and provide user-friendly names for security groups. The security group table maps SGTs
to security group names. Consult your ISE configuration for the valid tags and names.
•group-object object_group_name—The name of an existing security group object group.
Example
hostname(config-security-object-group)# security-group tag 1
hostname(config-security-object-group)# security-group name mgkt
hostname(config-security-object-group)# group-object local-sg
Step 3 (Optional) Add a description.