Using Object Groups In An Acl; Example Of Configuring An Extended Acl Without Object Groups; Example Of Configuring The Equivalent Extended Acl Using Object Groups; Example Of How An Object Group Expands Into Multiple Acl Entries - Cisco 4700M Configuration Manual

Simplifying Access Control Lists with Object Groups

Using Object Groups in an ACL

Example of Configuring an Extended ACL Without Object Groups

Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide
1-28
To use object groups in an ACL, replace the normal network (source_address
mask, and so on), service (protocol operator port), or ICMP type (icmp_type)
arguments with the object-group name keyword and argument.
For example, to use object groups for all available parameters in the access-list
extended command, enter the following command:
host1/Admin(config)# access-list acl_name extended {deny | permit}
object-group service_grp_name object-group network_grp_name
object-group network_grp_name
You do not have to use object groups for all parameters. For example, you can use
an object group for the source address, but identify the destination address with
an IP address and subnet mask.
The following subsections provide examples of configuring extended ACLs with
and without object groups, and how object group entries expand into multiple
ACL entries:
Example of Configuring an Extended ACL Without Object Groups
•

Example of Configuring the Equivalent Extended ACL Using Object Groups

•

Example of How an Object Group Expands into Multiple ACL Entries

•
The following example shows how to configure an extended ACL that does not
use object groups to restrict several hosts on the inside network from accessing
several web servers. All other traffic is allowed.
host1/Admin(config)# access-list ACL_IN remark "object-group acl to
deny specific hosts"
host1/Admin(config)# access-list ACL_IN extended deny tcp host
10.1.1.4 host 209.165.201.29 eq www
host1/Admin(config)# access-list ACL_IN extended deny tcp host
10.1.1.78 host 209.165.201.29 eq www
host1/Admin(config)# access-list ACL_IN extended deny tcp host
10.1.1.89 host 209.165.201.29 eq www
host1/Admin(config)# access-list ACL_IN extended deny tcp host
10.1.1.4 host 209.165.201.16 eq www
host1/Admin(config)# access-list ACL_IN extended deny tcp host
10.1.1.78 host 209.165.201.16 eq www
host1/Admin(config)# access-list ACL_IN extended deny tcp host
10.1.1.89 host 209.165.201.16 eq www
Chapter 1 Configuring Security Access Control Lists
OL-16202-01