I need to open and map a range of UDP port 15000-15511

[userice]

HI,
I need to open and map a range of udp ports (15000~15511) Is there a good way to do it without type in access-list, and static commands 551 times.

 

[garnetbobcat]

Use the "range" operator. For example:

access-list MYACL ex permit udp any any range 15000 15511

See the "operator" box in the table under the "access-list extended" command:

http://www.cisco.com/en/US/docs/security/asa/asa72/command/reference/a1_72.html#wp1444018

Matt
CCSP

http://www.wr-mem.com

 

[brianinms]

What version OS are you running on your PIX? How many public ip addresses do you have?

 

[userice]

I also need to map 15000~15551 to 10.10.1.3. Is there a better way to do this?

 

[userice]

I am running 6.3.5, and I have 5 public IPs, but I only use 1 public IP

 

[brianinms]

object-group service Allowed udp
port-object range 15000 15511

static (inside,outside) pub1 inside1 netmask 255.255.255.255

static (inside,outside) pub2 inside2 netmask 255.255.255.255


access-list out-in permit udp any host pub1 eq object-group Allowed

access-list out-in permit udp any host pub2 eq object-group Allowed

 

[brianinms]

Oh and I forgot

access-group out-in in interface outside

 

[userice]

Thank you for your fast reply. When I entered those commands, I got “WARNING: mapped-address conflict with existing static” What should I do with that?
For example: WARNING: mapped-address conflict with existing static tcp from inside:10.10.1.1/80 to outside:79.x.y.z/80 netmask 255.255.255.255

 

[brianinms]

You can't have two statics for the same ip address.

 

[userice]

Sorry, I guess I am getting confused. I should tell you the whole story. We have 5 IPs, but we only use 1. I have port 80, and port 443 mapped to 10.10.1.1. But, I need to map udp port 1065, udp port 2178, udp ports 15000~15551, and tcp port 8782 mapped to 10.10.1.3. When I do static (inside,outside) pub1 inside1 netmask 255.255.255.255, it caused some sort of conflict.

 

[brianinms]

You will have to replace the statement with your actual Ip addresses ... sorry for not being clear


static (inside,outside) pub1 inside1 netmask 255.255.255.255


Assume public ip is 100.1.1.1 and inside ip is 10.10.1.3


static (inside,outside) 100.1.1.1 10.10.1.3 netmask 255.255.255.255

 

[userice]

I did this:
object-group service Allowed udp
port-object range 15000 15511

but when I enter this:
access-list 100 permit udp any host w.x.y.z eq object-group Allowed

it also give me this:
Result of firewall command: "access-list 100 permit udp any host w.x.y.z eq object-group Allowed"

ERROR: invalid port object-group
Usage: [no] access-list compiled
[no] access-list deny-flow-max <n>
[no] access-list alert-interval <secs>
[no] access-list <id> object-group-search
[no] access-list <id> compiled
[no] access-list <id> [line <line-num>] remark <text>
[no] access-list <id> [line <line-num>] deny|permit
<protocol>|object-group <protocol_obj_grp_id>
<sip> <smask> | interface <if_name> | object-group <network_obj_grp_id>
[<operator> <port> [<port>] | object-group <service_obj_grp_id>]
<dip> <dmask> | interface <if_name> | object-group <network_obj_grp_id>
[<operator> <port> [<port>] | object-group <service_obj_grp_id>]
[log [disable|default] | [<level>] [interval <secs>]]
[no] access-list <id> [line <line-num>] deny|permit icmp
<sip> <smask> | interface <if_name> | object-group <network_obj_grp_id>
<dip> <dmask> | interface <if_name> | object-group <network_obj_grp_id>
[<icmp_type> | object-group <icmp_type_obj_grp_id>]
[log [disable|default] | [<level>] [interval <secs>]]
Restricted ACLs for route-map use:
[no] access-list <id> deny|permit {any | <prefix> <mask> | host <address>}
Command failed

 

[brianinms]

Sorry, take out the eq

access-list 100 permit udp any host w.x.y.z object-group Allowed


I should have configured it in my lab to test first

 

[userice]

Thank you so much for you help. I have another question.
I also have commands like those:

access-group 100 in interface outside
static (inside,outside) tcp interface

http://www 10.10.1.1

http://www netmask

255.255.255.255 0 0
static (inside,outside) tcp interface 3389 10.10.1.1 3389 netmask 255.255.255.255 0 0
static (inside,outside) tcp interface https 10.10.1.2 https netmask 255.255.255.255 0 0

If I enter the following command, it will cause conflicts. What should I do?
static (inside,outside) 100.1.1.1 10.10.1.3 netmask 255.255.255.255