How to correct invalid services (from ASA)

[karundeep]

Hi,

I'm migrating Cisco ASA security policies and showing some invalid services. 

icmp-echo

icmp-traceroute

Please let me know the correct services and how to replace it in service groups.

Thanks,

Karun

[trcoates]

Hi there,

(edit: misspellings and additional info)

icmp-echo - Is this just for pings? If so, that would just be PA's "ping." You also have the option of "icmp." I frequently use both in an application group in case they're identified differently.

icmp-traceroute - This would likely just be PA's "traceroute."

In fact, I often use an application group that has all kinds of echo-related applications, ping, icmp, traceroute, etc. Then I can just reference that later.

Here's a link to their Application Research Center if you don't already have it, or "Applipedia." This way you can look through the descriptions to see if the ones listed above meet your needs.

[DimensionNS]

Right click on the invalid service and select "Search & Replace"

This will bring you to the "Tools" menu

Select the service you want to replace in left pane

The right pane will show where used

Select all of the objects ( or just the ones you want to replace )

Click "Add to replace" at the bottom

Click the "Replace" tab in the right pane

Select the drop down for "Replace by" and choose what you want ( In your example could select "Applications")

Select the drop down for "To", select ICMP or similar for your example

In the "Options" menu select how you want to handle the replace.  Depending on what else is in the service-group you may need to split the rules.  By splitting the rule it will make an additional rule with just the "ICMP" application.  You would need to do this if the service group contained tcp/udp service ports as the rule won't work with both service and application defined, well at least not the way you want it to...

Click "Replace All" at bottom right to execute.