Simplifying Access Control Lists With Object Grouping; How Object Grouping Works - Cisco Catalyst 6500 Series Configuration Manual

Simplifying Access Control Lists with Object Grouping

The following command adds a standard ACE. To add another ACE at the end of the ACL, enter another
access-list command specifying the same ACL name. Apply the ACL using the
section on page
To add an ACE, enter the following command:
FWSM(config)# access-list acl_name standard {deny | permit} {any | ip_address mask }
The following sample ACL identifies routes to 192.168.1.0/24:
FWSM(config)# access-list OSPF standard permit 192.168.1.0 255.255.255.0
Simplifying Access Control Lists with Object Grouping
This section describes how to use object grouping to simplify ACL creation and maintenance, and
includes the following topics:
•
•
•
•
•
•

How Object Grouping Works

By grouping like-objects together, you can use the object group in an ACE instead of having to enter an
ACE for each object separately. You can create the following types of object groups:
•
•
•
•
For example, consider the following three object groups:
•
•
•
After creating these groups, you could use a single ACE to allow trusted hosts to make specific service
requests to a group of public servers.
You can also nest object groups in other object groups.
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide
10-18
8-6.
How Object Grouping Works, page 10-18
Adding Object Groups, page 10-19
Nesting Object Groups, page 10-22
Displaying Object Groups, page 10-24
Removing Object Groups, page 10-24
Using Object Groups with an Access Control List, page 10-23
Protocol
Network
Service
ICMP type
MyServices—Includes the TCP and UDP port numbers of the service requests that are allowed
access to the internal network
TrustedHosts—Includes the host and network addresses allowed access to the greatest range of
services and servers
PublicServers—Includes the host addresses of servers to which the greatest access is provided
Chapter 10 Controlling Network Access with Access Control Lists
"Adding a Route Map"
OL-6392-01