Cisco 7604 Configuration Guide - Page 239

Chapter 13 Identifying Traffic with Access Lists Simplifying Access Lists with Object Grouping The protocol is the numeric identifier of the specific IP protocol (1 to 254) or a keyword identifier (for example, icmp, tcp, or udp). To include all IP protocols, use the keyword ip. For a list of protocols you can specify, see the "Protocols and Applications" section on page E-11. For example, to create a protocol group for TCP, UDP, and ICMP, enter the following commands: hostname(config)# object-group protocol tcp_udp_icmp hostname(config-protocol)# protocol-object tcp hostname(config-protocol)# protocol-object udp hostname(config-protocol)# protocol-object icmp Adding a Network Object Group To add or change a network object group, perform the following steps. After you add the group, you can add more objects as required by following this procedure again for the same group name and specifying additional objects. You do not need to reenter existing objects; the commands you already set remain in place unless you remove them with the no form of the command. Note A network object group supports IPv4 and IPv6 addresses, depending on the type of access list. For more information about IPv6 access lists, see "Configuring IPv6 Access Lists" section on page 10-5. To add a network group, perform the following steps: Step 1 Step 2 Step 3 To add a network group, enter the following command: hostname(config)# object-group network grp_id The grp_id is a text string up to 64 characters in length. The prompt changes to network configuration mode. (Optional) To add a description, enter the following command: hostname(config-network)# description text The description can be up to 200 characters. To define the networks in the group, enter the following command for each network or address: hostname(config-network)# network-object {host ip_address | ip_address mask} For example, to create network group that includes the IP addresses of three administrators, enter the following commands: hostname(config)# object-group network admins hostname(config-network)# description Administrator Addresses hostname(config-network)# network-object host 10.1.1.4 hostname(config-network)# network-object host 10.1.1.78 hostname(config-network)# network-object host 10.1.1.34 OL-20748-01 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM 13-13