Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 217)

100

101

13-15

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 13 Identifying Traffic with Access Lists

Simplifying Access Lists with Object Grouping

For example, to create a protocol group for TCP, UDP, and ICMP, enter the following commands:

hostname(config)# object-group protocol tcp_udp_icmp

hostname(config-protocol)# protocol-object tcp

hostname(config-protocol)# protocol-object udp

hostname(config-protocol)# protocol-object icmp

Adding a Network Object Group

To add or change a network object group, follow these steps. After you add the group, you can add more

objects as required by following this procedure again for the same group name and specifying additional

objects. You do not need to reenter existing objects; the commands you already set remain in place unless

you remove them with the no form of the command.

Note A network object group supports IPv4 and IPv6 addresses, depending on the type of access list. For more

information about IPv6 access lists, see “Configuring IPv6 Access Lists” section on page 9-4.

To add a network group, follow these steps:

Step 1 To add a network group, enter the following command:

hostname(config)# object-group network

grp_id

The grp_id is a text string up to 64 characters in length.

The prompt changes to network configuration mode.

Step 2 (Optional) To add a description, enter the following command:

hostname(config-network)# description

text

The description can be up to 200 characters.

Step 3 To define the networks in the group, enter the following command for each network or address:

hostname(config-network)# network-object {host

ip_address

ip_address mask

}

For example, to create network group that includes the IP addresses of three administrators, enter the

following commands:

hostname(config)# object-group network admins

hostname(config-network)# description Administrator Addresses

hostname(config-network)# network-object host 10.1.1.4

hostname(config-network)# network-object host 10.1.1.78

hostname(config-network)# network-object host 10.1.1.34

Adding a Service Object Group

To add or change a service object group, follow these steps. After you add the group, you can add more

objects as required by following this procedure again for the same group name and specifying additional

objects. You do not need to reenter existing objects; the commands you already set remain in place unless

you remove them with the no form of the command.

1 2 ... 212 213 214 215 216 217 218 219 220 221 222 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 217

Kommentare zu diesen Handbüchern