: Saved
:
ASA Version 8.3(2) 
!
hostname asa5505


interface Vlan1
  nameif inside
  security-level 100
  ip address 192.168.1.1 255.255.255.0 
exit

interface Vlan2
  nameif outside
  security-level 0
  ip address dhcp setroute 
exit

interface Ethernet0/0
  description Switch port 0/0
exit


no logging buffered
no logging console
no logging timestamp
no logging on


timeout xlate 0:0:0 
timeout conn 0:0:0 
timeout udp 0:0:0 
timeout sunrpc 0:0:0 
timeout h323 0:0:0 
timeout sip 0:0:0 
timeout sip_media 0:0:0 
timeout half-closed 0:0:0 
timeout uauth 0:0:0 


clear config ssh
aaa authentication ssh console LOCAL

clear config snmp-server
no snmp-server enable traps

clear config ntp


no service resetinbound
no service resetoutside
no sysopt connection timewait
no sysopt nodnsalias inbound
no sysopt nodnsalias outbound


class-map inspection_default
  match default-inspection-traffic

policy-map global_policy
  class inspection_default

service-policy global_policy global



clear xlate
clear config nat
clear config access-list
clear config icmp
clear config telnet
clear config object-group
clear config object


object service http.0
  service tcp destination eq 80
exit

object service https.0
  service tcp destination eq 443
exit

object service match-1
 service tcp destination eq 80

object service match-2
 service tcp destination lt 1024

object network server-1.0
  host 192.168.1.100
exit

object network Internal_net.0
  subnet 192.168.1.0 255.255.255.0
exit

object network external_net.0
  subnet 192.0.2.0 255.255.255.0

object-group service id5102X14531.srv.tcp.0 tcp
  port-object eq 80
  port-object eq 443
exit

object service ip2 
 service eigrp 

object-group protocol pg1
 protocol-object 111
 protocol-object ah
 protocol-object ip
 protocol-object eigrp

object-group network src-network-group-1
 network-object 192.168.1.0 255.255.255.0
 network-object 192.168.2.0 255.255.255.0

object-group network dst-network-group-1
 network-object object external_net.0

object-group service test-service-1 tcp
 port-object eq www

object-group service test-service-2 tcp
 port-object range 1000 1010

object-group service test-service-3 tcp
 port-object eq 25
 group-object test-service-1

object-group service test-service-4 tcp
 port-object eq 25
 port-object eq 88
 group-object test-service-1



!################
! 

! remark
access-list inside_in  remark 0 (global)

! protocols, including named object and object group
!
access-list inside_in  extended permit   ah 192.168.1.0 255.255.255.0 any
access-list inside_in  extended permit   eigrp 192.168.1.0 255.255.255.0 any
access-list inside_in  extended permit   esp 192.168.1.0 255.255.255.0 any
access-list inside_in  extended permit   gre 192.168.1.0 255.255.255.0 any
access-list inside_in  extended permit   icmp 192.168.1.0 255.255.255.0 any
!  access-list inside_in  extended permit   icmp6 192.168.1.0 255.255.255.0 any
access-list inside_in  extended permit   igmp 192.168.1.0 255.255.255.0 any
access-list inside_in  extended permit   igrp 192.168.1.0 255.255.255.0 any
access-list inside_in  extended permit   ip 192.168.1.0 255.255.255.0 any
access-list inside_in  extended permit   ipinip 192.168.1.0 255.255.255.0 any
access-list inside_in  extended permit   ipsec 192.168.1.0 255.255.255.0 any
access-list inside_in  extended permit   nos 192.168.1.0 255.255.255.0 any
access-list inside_in  extended permit   object ip2 192.168.1.0 255.255.255.0 any
access-list inside_in  extended permit   object-group pg1 192.168.1.0 255.255.255.0 any
access-list inside_in  extended permit   ospf 192.168.1.0 255.255.255.0 any
access-list inside_in  extended permit   pcp 192.168.1.0 255.255.255.0 any
access-list inside_in  extended permit   pim 192.168.1.0 255.255.255.0 any
access-list inside_in  extended permit   pptp 192.168.1.0 255.255.255.0 any
access-list inside_in  extended permit   snp 192.168.1.0 255.255.255.0 any
access-list inside_in  extended permit   tcp 192.168.1.0 255.255.255.0 any
access-list inside_in  extended permit   udp 192.168.1.0 255.255.255.0 any

! named object reference in source
access-list inside_in extended permit ip object Internal_net.0 any 
access-list inside_in  remark 3 (global)

! logging
access-list inside_in extended deny   ip any any log
! interval w/o level
access-list inside_in extended deny   ip any any log interval 100
! level w/o interval, numeric and a word
access-list inside_in extended deny   ip any any log 1
access-list inside_in extended deny   ip any any log alerts
access-list inside_in extended deny   ip any any log disable
! both level and interval
access-list inside_in extended deny   ip any any log 0 interval 300


! more complex tests: named objects, object groups, inline address and
! port definitions in both source and destination

access-list inside_in extended permit tcp object server-1.0 object-group id5102X14531.srv.tcp.0 any

access-list inside_in extended permit tcp object server-1.0 object-group dst-network-group-1

access-list inside_in extended permit tcp object server-1.0 eq 80 any
access-list inside_in extended permit tcp object server-1.0 gt 1010 any
access-list inside_in extended permit tcp object server-1.0 lt 1024 any
access-list inside_in extended permit tcp object server-1.0 range 1010 1020 any
access-list inside_in extended permit tcp object server-1.0 neq 88 any

access-list inside_in extended permit tcp 192.168.2.0 255.255.255.192 object-group id5102X14531.srv.tcp.0  any
access-list inside_in extended permit tcp 192.168.2.0 255.255.255.192 eq 80 any
access-list inside_in extended permit tcp 192.168.2.0 255.255.255.192 gt 1010 any
access-list inside_in extended permit tcp 192.168.2.0 255.255.255.192 lt 1024 any
access-list inside_in extended permit tcp 192.168.2.0 255.255.255.192 range 1010 1020 any
access-list inside_in extended permit tcp 192.168.2.0 255.255.255.192 neq 88 any

access-list inside_out extended permit tcp any object server-1.0 object-group id5102X14531.srv.tcp.0 
access-list inside_out extended permit tcp any object server-1.0 eq 80
access-list inside_out extended permit tcp any object server-1.0 gt 1010
access-list inside_out extended permit tcp any object server-1.0 lt 1024
access-list inside_out extended permit tcp any object server-1.0 range 1010 1020
access-list inside_out extended permit tcp any object server-1.0 neq 88

access-list inside_out extended permit tcp any 192.168.2.0 255.255.255.192 object-group id5102X14531.srv.tcp.0 
access-list inside_out extended permit tcp any 192.168.2.0 255.255.255.192 eq 80
access-list inside_out extended permit tcp any 192.168.2.0 255.255.255.192 gt 1010
access-list inside_out extended permit tcp any 192.168.2.0 255.255.255.192 lt 1024
access-list inside_out extended permit tcp any 192.168.2.0 255.255.255.192 range 1010 1020
access-list inside_out extended permit tcp any 192.168.2.0 255.255.255.192 neq 88

! invalid port name
access-list inside_out extended permit tcp any 192.168.2.0 255.255.255.192 neq foo

access-list inside_out extended permit tcp any object-group dst-network-group-1

access-list inside_out extended permit tcp object-group src-network-group-1 object-group dst-network-group-1

access-list inside_out extended permit tcp object-group src-network-group-1 gt 1023 object-group dst-network-group-1 eq 80

access-list inside_out extended permit tcp object-group src-network-group-1 gt 1023 object-group dst-network-group-1 neq 88

access-list inside_out extended permit tcp any eq www any range 1024 65535
access-list inside_out permit tcp any range 1080 1090 any range 1080 1090

access-list outside_out standard permit 192.0.2.0 255.255.255.0 
access-list outside_out standard permit host 192.0.2.1
access-list outside_out standard permit any

! test for access list using service group that matches destination port to match
! service port
access-list outside_in  permit tcp object-group dst-network-group-1 object-group test-service-1 any
access-list outside_in  permit tcp object-group dst-network-group-1 object-group test-service-2 any
access-list outside_in  permit tcp object-group dst-network-group-1 object-group test-service-3 any
access-list outside_in  permit tcp object-group dst-network-group-1 object-group test-service-4 any

! same groups but matching destination ports

access-list outside_in  permit tcp object-group dst-network-group-1 gt 1024 any object-group test-service-1
access-list outside_in  permit tcp object-group dst-network-group-1 gt 1024 any object-group test-service-2
access-list outside_in  permit tcp object-group dst-network-group-1 gt 1024 any object-group test-service-3
access-list outside_in  permit tcp object-group dst-network-group-1 gt 1024 any object-group test-service-4

! unsupported configuration: neq in bouth source and destination
access-list outside_in permit tcp any neq www any neq www

! however named object can not be used to match source ports in ASA
! 8.3 so the following rules are invalid
!
! access-list outside_in  permit tcp object-group dst-network-group-1 object match-1 any
! access-list outside_in  permit tcp object-group dst-network-group-1 object match-2 any


! tests for access lists using object groups for both source service and destination address
!
access-list inside_in permit tcp 192.168.1.0 255.255.255.0 object-group test-service-1 host 4.2.2.1 object-group test-service-2
access-list inside_in permit tcp 192.168.1.0 255.255.255.0 object-group test-service-2 host 4.2.2.1 object-group test-service-1
access-list inside_in permit tcp 192.168.1.0 255.255.255.0 object-group test-service-1 host 4.2.2.1 object-group test-service-3
access-list inside_in permit tcp 192.168.1.0 255.255.255.0 object-group test-service-3 host 4.2.2.1 object-group test-service-1
access-list inside_in permit tcp 192.168.1.0 255.255.255.0 object-group test-service-1 host 4.2.2.1 gt 1024
access-list inside_in permit tcp 192.168.1.0 255.255.255.0 gt 1024 host 4.2.2.1 object-group test-service-1




! access-group statements

access-group inside_in in interface inside
access-group inside_out out interface inside
access-group outside_in in interface outside
access-group outside_out out interface outside

