: Saved
:
ASA Version 8.3(2) 
!
hostname asa5505
!
interface Vlan1
 description inside interface
 nameif inside
 security-level 100
 ip address dhcp setroute 
!
interface Vlan2
 description outside interface
 nameif outside
 security-level 0
 ip address 192.168.2.1 255.255.255.0 
!
interface Ethernet0/0
 description Switch port 0/0
 switchport access vlan 2
!

!
object network internal_subnet_1 
 subnet 192.168.1.0 255.255.255.192
 description Internal Subnet 1
object network internal_subnet_2 
 subnet 192.168.1.64 255.255.255.192
 description Internal Subnet 2
! this object matches network in standard objects lib, but it should be created anyway
object network internal_subnet_3
 subnet 192.168.1.0 255.255.255.0
 description Internal Subnet 1
! this object matches internale_subnet_1 but has different name and should be created
object network internal_subnet_4
 subnet 192.168.1.0 255.255.255.192

object network Internal_net 
 subnet 192.168.1.0 255.255.255.0
object network outside_range-1 
 range 22.22.22.30 22.22.22.40
object network range_1
 range 10.1.1.1 10.1.1.100
object network firewall90:FastEthernet1:ip-1 
 host 22.22.22.23
object network hostA:eth0 
 host 192.168.1.10
object network spamhost1 
 host 61.150.47.112
object network spamhost2 
 host 61.150.47.113
object network external_gw2 
 host 22.22.22.100
!
! Example of a named object with "nat" command
!
object network my-range-obj
 range 10.2.2.1 10.2.2.10
object network my-inside-net
 subnet 192.168.2.0 255.255.255.0
 nat (inside,outside) dynamic my-range-ob
!

! ipv6 addresses
!
object network ipv6-host-object-1 
 host 2001:0db8:85a3:0000:0000:8a2e:0370:7334
 description Example of IPv6 host object 
object network ipv6-network-object-1 
 subnet 2001::/64
 description IPv6 network object example 
object network ipv6-host-object-3
 host fe80::202:b3ff:fe1e:8329
 description Example of IPv6 host object 
object network ipv6-host-object-3
 host a1b2:c3d4:e5f6:b3ff:fe1e:8329:0:1234
 description Example of IPv6 host object 

! empty named object definition
object network dummy-address
!
! more good network objects after the empty one
object network internal_subnet_5
 subnet 10.10.1.0 255.255.255.0
!
! another test for an empty object and non-empty object but no comments this time
object network dummy-address-1
object network internal_subnet_6
 subnet 10.10.2.0 255.255.255.0
!
object network ipv6-host-object-2
 host 2001:af::1
 description Test IPv6 host
object network host-1
 host 10.0.0.1

!
object service smtp 
 service tcp destination eq smtp 
object service http 
 service tcp destination eq www 
object service ssh
 service tcp destination eq 22
object service squid 
 service tcp destination eq 3128 
object service smtps 
 service tcp destination eq 465 
!
object service icmp1 
 service icmp echo
object service icmp2 
 service icmp unreachable
object service ip5 
 service 111 
!

object service tcp-src-1
 service tcp source lt 1024
 description object description tcp src 1
object service tcp-src-2
 service tcp source gt 1024
object service tcp-src-3
 service tcp source eq 80
object service tcp-src-4
 service tcp source neq 88
object service tcp-src-5
 service tcp source range 1000 1010
!
object service tcp-dst-1
 service tcp destination lt 1024
object service tcp-dst-2
 service tcp destination gt 1024
object service tcp-dst-3
 service tcp destination eq 80
object service tcp-dst-4
 service tcp destination neq 88
object service tcp-dst-5
 service tcp destination range 1001 1011
!

object service tcp-src-dst-1
 service tcp source lt 1024 destination eq 80
object service tcp-src-dst-2
 service tcp source gt 1024 destination eq 2222
object service tcp-src-dst-3
 service tcp source eq 80 destination gt 1024
object service tcp-src-dst-4
 service tcp source neq 88 destination gt 1024
object service tcp-src-dst-5
 service tcp source range 1002 1012 destination gt 1024
!

object service udp-src-1
 service udp source lt 1024
object service udp-src-2
 service udp source gt 1024
object service udp-src-3
 service udp source eq 80
object service udp-src-4
 service udp source neq 88
object service udp-src-5
 service udp source range 1000 1010
!
object service udp-dst-1
 service udp destination lt 1024
object service udp-dst-2
 service udp destination gt 1024
object service udp-dst-3
 service udp destination eq 80
object service udp-dst-4
 service udp destination neq 88
object service udp-dst-5
 service udp destination range 1001 1011
!

object service ip1 
 service ip 
object service ip2 
 service eigrp 
object service icmp6-1 
 service icmp6 neighbor-advertisement
!
! named object using unknown protocol name
object service ip3
 service some_weird_protocol

! incomplete statement
!
object service ip4 

!
object-group network outside.id178211X29963.osrc.net.0
 network-object object internal_subnet_1
 network-object object internal_subnet_2
object-group network outside.id21353X4994.osrc.net.0
 network-object object internal_subnet_1
 network-object object Internal_net
 network-object object internal_subnet_2
object-group network outside.id77971X5929.osrc.net.1
 network-object object internal_subnet_1
 network-object object internal_subnet_2
object-group network outside.id77971X5929.odst.net.1
 network-object object spamhost1
 network-object object spamhost2
object-group network outside.id77971X5929.tsrc.net.1
 network-object object outside_range-1
 network-object object external_gw2
object-group network outside.id77971X5929.osrc.net.0
 network-object object internal_subnet_1
 network-object object internal_subnet_2
object-group network outside.id77971X5929.odst.net.0
 network-object object spamhost1
 network-object object spamhost2
object-group network outside.id77971X5929.tsrc.net.0
 network-object object outside_range-1
 network-object object external_gw2

object-group service outside.id77971X5929.osrv.1
 service-object object smtp 
 service-object object smtps 

object-group service sg1
 service-object ip 
 service-object eigrp 
 service-object gre 
 service-object 111
object-group service sg2
 service-object icmp echo
 service-object icmp echo-reply
 service-object icmp 111
object-group service sg3
 service-object tcp source gt 1024 destination eq www 
 service-object tcp source gt 1024 destination range 10000 10010 
 service-object tcp source gt 1024 destination neq www 
 service-object tcp source gt 1024 destination lt 1024 
 service-object tcp destination eq 22
object-group service sg4
 service-object tcp source gt 1024 
 service-object tcp source lt 1024 
 service-object tcp source eq www 
 service-object tcp source neq www 
object-group service sg5
 service-object udp source gt 1024 
 service-object udp source gt 1024 destination eq www 
 service-object udp destination eq domain
 service-object udp destination eq 5353
 service-object object udp-dst-1
 service-object object udp-dst-2
 group-object sg1
 group-object sg2
!

object-group service combo-group-1
 service-object tcp-udp eq 10000
 service-object tcp-udp lt 1024
 service-object tcp-udp gt 1024
object-group service neq-group-2
 service-object tcp neq www 
 service-object tcp neq 81 
 service-object tcp neq 82 
 service-object tcp-udp neq 82 
 service-object tcp-udp neq 83 
 service-object tcp-udp neq 84 
 service-object udp neq 85 
 service-object udp neq 86 
 service-object udp neq 87 
 service-object udp neq www 
 service-object udp neq nfs 
 service-object udp neq radius 
 service-object udp neq radius-acct 
 service-object tcp neq ident 

object-group protocol pg1
 protocol-object 111
 protocol-object ah
 protocol-object ip
 protocol-object eigrp
object-group protocol pg2
 protocol-object 112
 protocol-object object ip5
 group-object pg1
!
object-group icmp-type ig1
 icmp-object echo
 icmp-object 111
object-group icmp-type ig2
 icmp-object echo-reply
 icmp-object 112
object-group icmp-type ig3
 icmp-object mask-reply
 group-object ig1

! also check for the terminating "exit" line (but this line is absent
! in show run output so we can't rely on it)
object-group service id5102X14531.srv.tcp.0 tcp
  port-object eq 80
  port-object eq 443
exit

object-group service tcp-udp-1 tcp-udp
 port-object eq 10001

access-list inside_in extended permit ip any any
access-group inside_in in interface inside
