Cisco 7604 Configuration Guide - Page 241

Chapter 13 Identifying Traffic with Access Lists Simplifying Access Lists with Object Grouping To add an ICMP type group, perform the following steps: Step 1 Step 2 Step 3 To add an ICMP type group, enter the following command: hostname(config)# object-group icmp-type grp_id The grp_id is a text string up to 64 characters in length. The prompt changes to ICMP type configuration mode. (Optional) To add a description, enter the following command: hostname(config-icmp-type)# description text The description can be up to 200 characters. To define the ICMP types in the group, enter the following command for each type: hostname(config-icmp-type)# icmp-object icmp_type See the "ICMP Types" section on page E-15 for a list of ICMP types. For example, to create an ICMP type group that includes echo-reply and echo (for controlling ping), enter the following commands: hostname(config)# object-group icmp-type ping hostname(config-service)# description Ping Group hostname(config-icmp-type)# icmp-object echo hostname(config-icmp-type)# icmp-object echo-reply Nesting Object Groups To nest an object group within another object group of the same type, first create the group that you want to nest according to the "Adding Object Groups" section on page 13-12. Then perform the following steps: Step 1 Step 2 To add or edit an object group under which you want to nest another object group, enter the following command: hostname(config)# object-group {{protocol | network | icmp-type} grp_id | service grp_id {tcp | udp | tcp-udp}} To add the specified group under the object group you specified in Step 1, enter the following command: hostname(config-group_type)# group-object grp_id The nested group must be of the same type. You can mix and match nested group objects and regular objects within an object group. OL-20748-01 For example, you create network object groups for privileged users from various departments: hostname(config)# object-group network eng hostname(config-network)# network-object host 10.1.1.5 hostname(config-network)# network-object host 10.1.1.9 hostname(config-network)# network-object host 10.1.1.89 hostname(config-network)# object-group network hr Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM 13-15