Displaying Object Groups; Removing Object Groups; Adding Remarks To Access Lists - Cisco PIX 500 Series Configuration Manual

Chapter 16 Identifying Traffic with Access Lists
hostname(config-network)# access-list ACL_IN extended deny tcp object-group denied
object-group web eq www
hostname(config)# access-list ACL_IN extended permit ip any any
hostname(config)# access-group ACL_IN in interface inside

Displaying Object Groups

To display a list of the currently configured object groups, enter the following command:
hostname(config)# show object-group [protocol | network | service | icmp-type | id grp_id ]
If you enter the command without any parameters, the system displays all configured object groups.
The following is sample output from the show object-group command:
hostname# show object-group
object-group network ftp_servers
description: This is a group of FTP servers
network-object host 209.165.201.3
network-object host 209.165.201.4
object-group network TrustedHosts
network-object host 209.165.201.1
network-object 192.168.1.0 255.255.255.0
group-object ftp_servers

Removing Object Groups

To remove an object group, enter one of the following commands.
You cannot remove an object group or make an object group empty if it is used in an access list.
Note
•
•

Adding Remarks to Access Lists

You can include remarks about entries in any access list, including extended, EtherType, and standard
access lists. The remarks make the access list easier to understand.
To add a remark after the last access-list command you entered, enter the following command:
hostname(config)# access-list access_list_name remark text
If you enter the remark before any access-list command, then the remark is the first line in the access list.
If you delete an access list using the no access-list access_list_name command, then all the remarks are
also removed.
OL-12172-03
To remove a specific object group, enter the following command:
hostname(config)# no object-group grp_id
To remove all object groups of the specified type, enter the following command:
hostname(config)# clear object-group [protocol | network | services | icmp-type]
If you do not enter a type, all object groups are removed.
Cisco Security Appliance Command Line Configuration Guide
Adding Remarks to Access Lists
16-17