Create and Edit ASA Service Objects
Create an ASA Service Object
In a service object, you can specify a single protocol and assign it to a source port, destination port, or both source and destination ports.
- Click the Objects tab to open the Objects page.
- Click Create Object > ASA > Service.
- Enter an object name.
- Select Create a service object
- Click the Service Type button and select the protocol for which you want to make an object.
- For TCP, UDP, and TCP-UDP service types, enter a source port, destination port, or both:
- The source port identifier allows you to match traffic originating from a particular numbered port. In the source port identifier, select an operator: equal to, range, less than, greater than, or not equal to and provide the appropriate port number or range.
- The destination port identifier allows you to match traffic arriving at a particular numbered port. In the destination port identifier, select an operator: equal to, range, less than, greater than, or not equal to and provide the appropriate port number or range.
- For Protocol service types, enter a protocol number between 0-255, or a well-known name, such as ip, tcp, udp, gre, and so forth.
- Click Add.
Examples
- A service object that identifies incoming FTP traffic would be one with a TCP Service type and a destination port range of 21.
- A service object that identifies outgoing DNS and DNS over TCP traffic would be one with a tcp-udb service type and a source port equal to 53.
Create an ASA Service Group
A service group can be made up of one or more service objects representing one or more protocols.
- Click the Objects tab to open the Objects page.
- Click Create Object > ASA > Service.
- Enter an object name.
- Select Create a service group.
- Add an existing object by clicking Add Object, selecting an object, and clicking Select. Repeat this step to add more objects.
- If needed, add an extra individual service type value to the service group
- For TCP, UDP, and TCP-UDP service types, enter a source port, destination port, or both:
- The source port identifier allows you to match traffic originating from a particular numbered port. In the source port identifier, select an operator: equal to, range, less than, greater than, or not equal to and provide the appropriate port number or range.
- The destination port identifier allows you to match traffic arriving at a particular numbered port. In the destination port identifier, select an operator: equal to, range, less than, greater than, or not equal to and provide the appropriate port number or range.
- For Protocol service types, enter a protocol number between 0-255, or a well-known name, such as ip, tcp, udp, gre, and so forth.
- To add more individual port values, click Add Another Value and repeat step 6.
- Click Add when you are done adding service objects and service values to the service group.
Edit an ASA Service Object or Service Group
- Click the Objects tab to open the Objects page.
- Filter the objects to find the object you want to edit and then select the object in the object table.
- In the details pane, click edit
.
- Edit the values in the dialog box in the same fashion that you created them in the procedures above.
- Click Save.
- CDO displays the policies that will be affected by the change. Click Confirm to finalize the change to the object and any policy affected by it.