Cisco 7604 Configuration Guide - Page 237

Chapter 13 Identifying Traffic with Access Lists Adding a Standard Access List The following access list denies traffic with EtherType 0x1256, but allows all others on both interfaces: hostname(config)# access-list nonIP ethertype deny 1256 hostname(config)# access-list nonIP ethertype permit any hostname(config)# access-group ETHER in interface inside hostname(config)# access-group ETHER in interface outside Adding a Standard Access List Standard access lists are used in some commands to identify the destination IP addresses only. For example, you use a standard access list to identify the destination addresses of OSPF routes for use in a route map for OSPF redistribution. Standard access lists cannot be applied to interfaces to control traffic. The following command adds a standard ACE. To add another ACE at the end of the access list, enter another access-list command specifying the same access list name. To add an ACE, enter the following command: hostname(config)# access-list access_list_name standard {deny | permit} {any | ip_address mask} The following sample access list identifies routes to 192.168.1.0/24: hostname(config)# access-list OSPF standard permit 192.168.1.0 255.255.255.0 Simplifying Access Lists with Object Grouping This section describes how to use object grouping to simplify access list creation and maintenance. This section includes the following topics: • How Object Grouping Works, page 13-11 • Adding Object Groups, page 13-12 • Nesting Object Groups, page 13-15 • Displaying Object Groups, page 13-17 • Removing Object Groups, page 13-17 • Using Object Groups with an Access List, page 13-16 How Object Grouping Works By grouping like-objects together, you can use the object group in an ACE instead of having to enter an ACE for each object separately. You can create the following types of object groups: • Protocol • Network • Service • ICMP type For example, consider the following three object groups: • MyServices-Includes the TCP and UDP port numbers of the service requests that are allowed access to the internal network OL-20748-01 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM 13-11