Adding A Standard Access List; Simplifying Access Lists With Object Grouping - Cisco 7604 Configuration Manual

Chapter 13 Identifying Traffic with Access Lists
The following access list denies traffic with EtherType 0x1256, but allows all others on both interfaces:
hostname(config)# access-list nonIP ethertype deny 1256
hostname(config)# access-list nonIP ethertype permit any
hostname(config)# access-group ETHER in interface inside
hostname(config)# access-group ETHER in interface outside

Adding a Standard Access List

Standard access lists are used in some commands to identify the destination IP addresses only. For
example, you use a standard access list to identify the destination addresses of OSPF routes for use in a
route map for OSPF redistribution. Standard access lists cannot be applied to interfaces to control traffic.
The following command adds a standard ACE. To add another ACE at the end of the access list, enter
another access-list command specifying the same access list name.
To add an ACE, enter the following command:
hostname(config)# access-list access_list_name standard {deny | permit} {any | ip_address
mask}
The following sample access list identifies routes to 192.168.1.0/24:
hostname(config)# access-list OSPF standard permit 192.168.1.0 255.255.255.0

Simplifying Access Lists with Object Grouping

This section describes how to use object grouping to simplify access list creation and maintenance. This
section includes the following topics:
•
•
•
•
•
•
How Object Grouping Works
By grouping like-objects together, you can use the object group in an ACE instead of having to enter an
ACE for each object separately. You can create the following types of object groups:
•
•
•
•
For example, consider the following three object groups:
•
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
How Object Grouping Works, page 13-11
Adding Object Groups, page 13-12
Nesting Object Groups, page 13-15
Displaying Object Groups, page 13-17
Removing Object Groups, page 13-17
Using Object Groups with an Access List, page 13-16
Protocol
Network
Service
ICMP type
MyServices—Includes the TCP and UDP port numbers of the service requests that are allowed
access to the internal network
Adding a Standard Access List
13-11