Access list with multiple object groups

Hello Everyone,
I am using a cisco ASA 5525 with 8.6 code. I am trying to setup access list for oubound access meaning hosts accessing the internet. I have created an access list called outbound_access and did "access-groupc outbound_access in interface inside "
I am trying to use object-groups where ever i can. Here is an example.
object-group service obj_Meraki_outbound
service-object tcp destination eq 443
service-object tcp destination eq 80
service-object tcp destination eq 7734
service-object tcp destination eq 7752
service-object udp destination eq 7351
object-group network obj_Meraki_lan
network-object 10.2.11.0 255.255.255.240
network-object 10.5.11.0 255.255.225.240
object-group network obj_Meraki_pub
des This group lists all hosts associated with Meraki.
network-object host 64.156.192.154
network-object host 64.62.142.12
network-object host 64.62.142.2
network-object host 74.50.51.16
network-object host 74.50.56.218
object-group service obj_Meraki_outbound
service-object tcp destination eq 443
service-object tcp destination eq 80
service-object tcp destination eq 7734
service-object tcp destination eq 7752
service-object udp destination eq 7351
object-group network obj_Meraki_lan
network-object 10.x.x.x 255.255.255.240
network-object 10.x.x.x 255.255.225.240
object-group network obj_Meraki_pub
des This group lists all hosts associated with Meraki.
network-object host 64.156.192.154
network-object host 64.62.142.12
network-object host 64.62.142.2
network-object host 74.50.51.16
network-object host 74.50.56.218
I have tried tying all these groups together in multiple ways but cannot figure out how to do this. This what i think it should be "access-list outbound_access extended permit object-group obj_Meraki_outbound object-group obj_Meraki_lan object-group obj_Meraki_pub"
What i want is the use the service objects and the source network would be obj_Meraki_lan and destination would be obj_Meraki_pub. It seems the rules completely change when you use object groups. Can someone explain this maybe with a few examples. I am already using object groups in many acls but not for every element.
Thanks

Hi,
Seems to work on my test ASA
Attached it to my current LAN interface.
ASA(config)# packet-tracer input LAN tcp 10.2.11.1 12345 64.156.192.154 80
Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 0.0.0.0 0.0.0.0 WAN
Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group outbound_access in interface LAN
access-list outbound_access extended permit object-group obj_Meraki_outbound object-group obj_Meraki_lan object-group obj_Meraki_pub
object-group service obj_Meraki_outbound
service-object tcp destination eq https
service-object tcp destination eq www
service-object tcp destination eq 7734
service-object tcp destination eq 7752
service-object udp destination eq 7351
object-group network obj_Meraki_lan
network-object 10.2.11.0 255.255.255.240
network-object 10.5.11.0 255.255.255.240
object-group network obj_Meraki_pub
description: This group lists all hosts associated with Meraki.
network-object host 64.156.192.154
network-object host 64.62.142.12
network-object host 64.62.142.2
network-object host 74.50.51.16
network-object host 74.50.56.218
Additional Information:
access-list outbound_access line 1 extended permit tcp 10.2.11.0 255.255.255.240 host 64.156.192.154 eq www (hitcnt=1) 0x4d812691
Also have used such configuration in some special cases where the customer has insisted on allow specific TCP/UDP ports between multiple networks. And nothing is stopping from adding ICMP into the "object-group service" also.
- Jouni

Similar Messages

List with multiple objects

Hi,
Is it possible can we have a List with multiple Object (CustomerVO, OrderVO and AddressVO) in a single List? If so how we will define the generics for that List?
Please clarify.
Thanks.

797836 wrote:
Guys, am I correct? Please clarify.If it works, it is correct. So try it.
I was more thinking along the line of this though according to what you described in your initial post:
Class ParentVO{
private CustomerVO customer;
private OrderVO order;
private AddressVO address;
// with getters and setters
}That way you don't need any list at all, if you only want to have access to these three objects. Just slap them in a ParentVO and use that.
Looking at it again I wonder if the ParentVO is needed even, there is a strong relationship between these three objects. An order has a customer and a customer has an address / an order has a billing/shipping address...

Extended access list with multiple ports

Hello All,
I have a problem with my Cisco Catalyst 4503-E when i try to configure an extended access lists with multipleports.
I receive the following message:
The informations of my Switch are the following:
Cisco IOS Software, Catalyst 4500 L3 Switch Software (cat4500-IPBASE-M), Version
12.2(52)SG, RELEASE SOFTWARE (fc1)
Please help me to resolve this problem.
Best regards.

Thank you Alex for your response.
Yes, this is an example:
permit tcp 192.168.1.0 0.0.0.255 host 192.168.2.1 eq 135 389 636 445 3268 3269 domain 88
I have more ACLs and each ACL contains more conditions with multiples Por

List with multiple objects using Comparator

Hi,
I have a comparator to sort the fields of 2 objects. I have a resultlist which contains the CustomerAddressVO which contains the properties of both
Customer and Address entities List resultList<CustomerAddressVO>.
This CustomerAddressVO.java in turn have
private long id
private Customer customer;
private Address address;
Where Customer.java
will have properties of customer
Where Address.java
will have properties of address
Now i need to use the comparator for customer.getName() asc and address.id() desc, as i have mentioned the resultList doesn't directly contain this object as it contains CustomerAddressVO which in turn have those two object Customer and Address. Hence unless you iterate the list and retrieve the respective objects (customer, address) you cannot do the sorting through comparator. In such case how we can go about it. If you iterate the list also how we can pass the respective object to the compare() ? And more importantly we need to sort the columns of 2 different entites? Please clarify how we can go about it?
Thanks.

You can still do the sorting through a Comparator
The compare method should take
public int compare(CustomerAddressVO o1, CustomerAddressVO o2) { //..so you can then do
01.getCustomer().getName();
//and
o1.getAddress().getId() together with relevant null checks

How to select value from list with multiple selections ?

HI,
i have a list with multiple selections where i show email address retrieved from database.
what i want to do is to send the selected email address to the invoiceedit.jsp.
please look at the following code which gives you the better idea.
<td class='smalltext'><select name="email" size="3" multiple="multiple">
   <%
   Connection conn = null;
   Statement stmt = null;
   Statement stmt_contactperson = null;
   Statement stmt_address = null;
   try{
      conn = getREConnection();
       stmt = conn.createStatement();
   ResultSet rs = null;
   rs = stmt.executeQuery("SELECT PROPERTYID, VALUE FROM PROPERTIES WHERE ENTITYID="+ g_strGroupID+" AND NAME = 'invoice_default_email'");
   int numofrows = 0;
   while(rs.next())
           %>
   <option value="<%= rs.getString("VALUE") %>" selected="selected"> <%= rs.getString("VALUE") %> </option>
    <%
       }//end of while
      %>
     </select>
    <a href="invoiceedit.jsp?entityid=<%=g_strGroupID%>&add=1"><font color="#000000">Add</font></a>
     <a href="invoiceedit.jsp?entityid=<%=g_strGroupID%>&email_to="><font color="#000000"> Edit</font></a> </td>thanks

Use a form button instead of a link so that you can send it as a request parameter to the server. In the server side just use HttpServletRequest#getParameterValues() to obtain all values for the given parameter name. If you really need a link rather than a button, then use Javascript to submit the form on click of the link.
That said, your design is bad. Java code belongs in Java classes, not in JSP files. Database access logic belongs in a DAO class. Business and controlling logic belongs in a Servlet class. Only presentation logic belongs in the JSP file. Avoid scriptlets as much as possible and use JSP EL and/or JSTL instead.

Creating Select List with multiple columns

I want to create a select list with multiple columns. I followed the demo application model described in the by Denes Kubicek (Currently my reference for APEX !!)
The code is as follows:
CREATE OR REPLACE FUNCTION getcrops(p_cropid IN NUMBER)
RETURN VARCHAR2
IS
v_cropid VARCHAR2 (400);
v_fcode VARCHAR2 (400);
v_product VARCHAR2 (400);
v_var VARCHAR2 (400);
v_fname VARCHAR2 (400);
v_acres VARCHAR2 (400);
v_style_start VARCHAR2 (400);
v_style_end VARCHAR2 (400);
v_return VARCHAR2 (400);
BEGIN
FOR c IN (select "CROP"."CROPID" as "CROP ID",
     "CROP"."FIELDCODE" as "FIELD CODE",
     "CARROTPRODUCTLIST"."CARROTPRODUCTNAME" as "PRODUCT",
     "VARIETYLIST"."VARIETYNAME" as "VARIETY",
     "FIELD"."FIELDNAME" as "FIELD NAME",
     "CROP"."SIZEINACRES" as "ACRES"
from     "FIELD" "FIELD",
     "CARROTPRODUCTLIST" "CARROTPRODUCTLIST",
     "VARIETYLIST" "VARIETYLIST",
     "CROP" "CROP"
where "CROP"."CARROTPRODUCTTYPE"="CARROTPRODUCTLIST"."CARROTPRODUCTID"
and     "CROP"."VARIETYID"="VARIETYLIST"."VARIETYLISTID"
and     "CROP"."FIELDID"="FIELD"."FIELDID")
LOOP
v_cropid := TO_CHAR (c.'CROP ID', 'FML999G999G999G999G990');
v_fcode := c.'FIELD CODE';
v_product := c.'PRODUCT';
v_var := c.'VARIETY';
v_fname :=c.'FIELD NAME';
v_acres :=c.'ACRES';
FOR i IN 1 .. 12 - LENGTH (c."CROP ID")
LOOP
v_cropid := v_cropid || ' ';
END LOOP;
FOR i IN 1 .. 12 - LENGTH (c.'FIELD CODE')
LOOP
v_fcode := v_fcode || ' ';
END LOOP;
FOR i IN 1 .. 12 - LENGTH (c.'PRODUCT')
LOOP
v_product := v_product || ' ';
END LOOP;
FOR i IN 1 .. 12 - LENGTH (c.'VARIETY')
LOOP
v_var := v_var || ' ';
END LOOP;
FOR i IN 1 .. 12 - LENGTH (c.'FIELD NAME')
LOOP
v_fname := v_fname || ' ';
END LOOP;
FOR i IN 1 .. 12 - LENGTH (c.'ACRES')
LOOP
v_acres := v_acres || ' ';
END LOOP;
v_return := v_cropid || v_fcode || v_product || v_var || v_fname || v_acres;
END LOOP;
RETURN v_return;
END;
I created this anonymous Pl/SQL function at a application level ..Then I followed up to create a select list with a function inside. However I could not create select list with the command suggested in the demo which is
select getcrops(cropid) d, cropid r from crop;
APEX (2.1) returns a error message. What am I missing ? Should the function be called from somewhere else after creating a regular select list..? Where the functions (Pl/SQL) should be ideally stored for application level access..? and for across application level access ? How can I check the function works good. Help is appreciated.

Still really one column.
If they need to be independent then you've got to have three selection lists.
%

APEX Pages - User Access List with NTLM

Hi,
I'm building several APEX Applications, and using NTLM as its Authentication Scheme. With this, the users won't have to type any user and password. And their user name stated in top right screen.
I'd like to build another application to administer users of all created APEX Applications. So I'd like to build 3 tables:
1. users (hold user name, and user data)
2. pages (hold APEX Applications pages)
3. access_list (hold combined data of users and pages and access flag)
The last table will give me an SQL that can be used to create page level Authorization Scheme.
The problem is:
I cannot find a way to get a list of user ids to pre-populated the table users. Is there a way that an administrator user use an LOV of all NTLM user instead of typing domain\user to this application? OR is there a better and elegant way to create User Access List with NTLM.
Your helps will really help me, and thanks in advance.
Regards,
Aulia

This is kind of a followup to Scott's post. Instead of using your own tables to map user accounts to permissions etc, why not simply use LDAP to query the NT domain global catalog?
You can tell what users are members of particular AD groups and control access to functions based on AD group membership. Then you would only need one table that maps Apex functionality to AD groups.
That's what we do. Our account management people add users to different security groups and they get access to our apex app based on those groups. The type of access is controlled by the group to which they belong.
If you try to capture a list of all users, you'll be constantly trying to keep your list of users in sync with your AD/NTLM accounts.
Or I guess you could simply use LDAP queries inside the database to get a list of ALL your users in a nightly batch. Wouldn't help for people added in the middle of the day, but maybe that doesn't happen often in your company.
I have posted code on using Active Directory LDAP with dbms_ldap inside the database. Shouldn't be too much trouble to modify that code to scan your directory for users every night. Search for "dbms_ldap" in this forum.

[svn:fx-trunk] 10943: Fix to dragging from List with multiple-selection

Revision: 10943
Author:   [email protected]
Date:     2009-10-08 15:46:27 -0700 (Thu, 08 Oct 2009)
Log Message:
Fix to dragging from List with multiple-selection
- The fix is to postpone the selection commit until we make sure the user has not started a drag gesture.
- Exclude the dragEnabled, dropEnabled, dragMoveEnabled properties for DropDownList
QE notes: None
Doc notes: None
Bugs: None
Reviewer: Deepa
Tests run: checkintests, mustella List, DropDownList
Is noteworthy for integration: No
Modified Paths:
    flex/sdk/trunk/frameworks/projects/spark/src/spark/components/DropDownList.as
    flex/sdk/trunk/frameworks/projects/spark/src/spark/components/List.as

Selection list with multiple columns

How can i create a selection list with multiple columns?

Still really one column.
If they need to be independent then you've got to have three selection lists.
%

Select list with multiple columns

I want to create a select list with multiple column option. What are the options. Any developments in apex 3.0.1 ? Thanks in advance. I tried the tutorials by Kubicek.
I am kind of stuck to see the function entry inside LOV definition returns a error.

Still really one column.
If they need to be independent then you've got to have three selection lists.
%

List with multiple selection

Hello;
I seek a code to implement a list with multiple selection for a browser Web (HTML is imited).
I have a list containing of the years, the user can select one or several years and I created dynamically a array : for each year a column.
Thank you;

Look at JList.
http://java.sun.com/j2se/1.4.2/docs/api/javax/swing/JList.html
� {�

List with multiple column

hello all ,
how to create a list with multiple columns ? can anyone share some examples or code snippets

What I would usually do is create a movieclip/sprite that contains a row with every column in it (each column being a textfield). Then pile up the rows one atop the other (using Actionscript) as they are populated with data.

Spiral/Vortex with Multiple Objects

Hi, all
I'm trying to replicate this image from Shutterstock with multiple objects to create this spiral vortex.
http://image.shutterstock.com/display_pic_with_logo/849265/101051014/stock-vector-card-sui t-hearts-diamonds-spades-and-clubs-playing-cards-op-art-vector-illustration-101051014.jpg
I looked up tutorials like this: http://vectorguru.com/tutorials/how-to-distribute-objects-along-spiral.html
Where I can put say the hearts on one spiral.
But, the image seems to be multiple spirals in a uniform and equidistant manner. I would like to know how to go about making a "vortex" with multiple objects very similar if not the same to this fashion.
Please advise.
Thanks!

Hi lotrismylife,
I was able to get a similar effect using the following steps:
Create a pattern brush of the 4 symbols next to each other (that way you can distribute them easily around the circle).
Start with the outermost circle, and apply the new pattern brush to it's stroke.
Expand the circle
Object > Transform > Transform Each (CTRL + ALT + SHIFT + D)
Set the horizontal & vertical scale to be smaller than 100% (you must experiment with this, depending on how big the gaps between circles must be)
Set the rotation angle (depending on how much each circle must rotate)
Click on Copy
Now continually press CTRL D - this will continue to create a copy of the outermost circle that is x % smaller, and x degrees rotated.
End result:

PC-UI: F4 with multiple object selection

Hi!
I implemented a F4-application with multiple object selection.
Now I want to give back some data to the application that called the f4 or I'd like to call a method of this class. How can I find the correct instance of this class?
Thanks in advance!
Jörn

Hi!
I used a DDIC table to exchange data. I forwarded the object_key and the F4-help application inserted the multiple objects with that key in that table.
The application which called the F4-help looked to the table (after pressing a button), grabbed the data and deleted the data in the DDIC table afterwards.
I hope that helps.
Jörn

Corrupted wiki list with multiple virtual host

Hello,
I have several virtual hosts and I want each of them to only list of wikis which are associated with them using the Wiki Admin Settings -> Advanced : Specific Host Names.
This does not seem to work. As soon as a wiki is associated to a specific virtual host it disappears from the list of wiki (http://hostname/groups/) (on all virtual hosts actually). The wiki itself can still be accessed by its explicit address: http:/hostname/groups/wikiname
If I manually edit the sql3 file directoryIndex.db in /Library/Application Support/Apple/WikiServer
and replace the specific host name by "*", the wiki reappears in the wiki list but on ALL virtual host. Still it remains accessible only in the one designated in the wiki Settings.
Most frustrating. Any workaround ? Seems like a bug but the wiki implementation being so convoluted I am not completely sure.
Any help ?
Thanks
Paul

Hi,
Seems to work on my test ASA
Attached it to my current LAN interface.
ASA(config)# packet-tracer input LAN tcp 10.2.11.1 12345 64.156.192.154 80
Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 0.0.0.0 0.0.0.0 WAN
Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group outbound_access in interface LAN
access-list outbound_access extended permit object-group obj_Meraki_outbound object-group obj_Meraki_lan object-group obj_Meraki_pub
object-group service obj_Meraki_outbound
service-object tcp destination eq https
service-object tcp destination eq www
service-object tcp destination eq 7734
service-object tcp destination eq 7752
service-object udp destination eq 7351
object-group network obj_Meraki_lan
network-object 10.2.11.0 255.255.255.240
network-object 10.5.11.0 255.255.255.240
object-group network obj_Meraki_pub
description: This group lists all hosts associated with Meraki.
network-object host 64.156.192.154
network-object host 64.62.142.12
network-object host 64.62.142.2
network-object host 74.50.51.16
network-object host 74.50.56.218
Additional Information:
access-list outbound_access line 1 extended permit tcp 10.2.11.0 255.255.255.240 host 64.156.192.154 eq www (hitcnt=1) 0x4d812691
Also have used such configuration in some special cases where the customer has insisted on allow specific TCP/UDP ports between multiple networks. And nothing is stopping from adding ICMP into the "object-group service" also.
- Jouni

Access list with multiple object groups

Similar Messages

Maybe you are looking for