Starting from IOS 12.4T Cisco are offering the facility for object groupings, those who use ASA/PIX will already be famliar with this concept. Benefits include allowing easier management of larger access lists as well as reducing configuration sizes. This can be implemented as follows:

Step 1. Define the Object Group:

! Define network type object-groups to group IP hosts and networks object-group network Engineering
10.240.12.0 255.255.255.0
10.245.10.0 255255.255.0
object-group network Web-Servers
10.1.1.0 255.255.255.0
host 10.10.10.100
object-group network Mail-Servers
10.32.1.0 255.255.255.0
! Define a service type object group to group you protocols and ports
object-group service Web-ports
tcp www
tcp 8080
object-group service Mail-ports
tcp smtp
tcp pop3
tcp 587
tcp 143

Step 2. Use Object Groups in ACL Configurations:

ip access-list extended access-policy
10 permit object-group Web-ports object-group Engineering object-group Web-Servers
20 permit object-group Mail-ports object-group Engineering object-group Mail-Servers

(All Examples used here and other new features can be found here)

Leave a Reply

Add to Technorati Favorites Add to Google