Configuring An Ipv4 Og Acl - Cisco Catalyst 4500 Series Software Configuration Manual

Chapter 62 Configuring Network Security with ACLs
Command or Action
Step 7
group-object nested-object-group-name
Example:
Switch(config-service-group)# group-object
my-nested-object-group
Step 8 Repeat the steps until you have specified objects on
which you want to base your object group.
Step 9 end
Example:
Switch(config-network-group)# end

Configuring an IPv4 OG ACL

When creating an object group ACL, configure an ACL that references one or more object groups. As
with conventional ACLs, you can associate the same access policy with one or more interfaces.
You can define multiple ACEs that reference object groups within the same object group ACL. You can
also reuse a specific object group in multiple ACEs. To create an object group ACL, perform the
following task:
Command or Action
Step 1 configure terminal
Example:
Switch# configure terminal
Step 2
ip access-list extended access-list-name
Example:
Switch(config)# ip access-list extended
my-ogacl-policy
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Purpose
(Optional) Specifies a nested (child) object group to be
included in the current (parent) object group.
The child object group type must match that of the parent
(for example, if you are creating a network object group,
you must specify another network object group as the
child).
You can use duplicate objects in an object group only by
nesting group objects. For example, if object 1 is in both
group A and group B, you can define a group C that
includes both A and B. However, you cannot include a
group object that causes the group hierarchy to become
circular (for example, you cannot include group A in group
B and then also include group B in group A).
While you can have an unlimited number of nested levels
we recommend a maximum of two levels.
—
Exits network object-group configuration mode and returns
to privileged EXEC mode.
Purpose
Enters global configuration mode.
Defines an extended IP access list using a name and enters
extended access-list configuration mode.
Configuring Object Group ACLs
62-43