Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 137)

3-25

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 3 Controlling Network Access and Use

Simplifying Access Control with Object Grouping

After creating these groups, you could use a single access rule to allow trusted hosts to make specific

service requests to a group of public servers. Object groups can also contain other object groups or be

contained by other object groups.

Object grouping dramatically compresses the number of access rules required to implement a particular

security policy. For example, a customer policy that required 3300 access rules might only require 40

rules after hosts and services are properly grouped.

Using Subcommand Mode

The general syntax of the object-group command is as follows:

object-group object-type grp-id

Replace object-type with one of the following object types:

• protocol—Group of IP protocols. It can be one of the keywords icmp, ip, tcp, or udp, or an integer

in the range 1 to 254 representing an IP protocol number. To match any Internet protocol, including

ICMP, TCP, and UDP, use the keyword ip.

• service—Group of TCP or UDP port numbers assigned to different services.

• icmp-type—Group of ICMP message types to which you permit or deny access.

• network—Group of hosts or subnets

Replace grp-id with a descriptive name for the group.

When you enter the object-group command, the prompt changes to the subcommand mode appropriate

for the type of object. Commands entered in the subcommand mode apply to the object type and group

name identified in the object-group command.

The prompts in each subcommand mode are as follows:

pix(config-protocol)#

pix(config-service)#

pix(config-icmp-type)#

pix(config-network)#

Enter a question mark (?) in the subcommand mode to view the permitted subcommands.

In subcommand mode, you can enter object grouping subcommands as well as all other PIX Firewall

commands including show commands and clear commands. When you enter any valid configuration

command, such as access-list, the subcommand mode is terminated. You can also terminate the

subcommand mode by entering the exit or quit commands. Subcommands are indented when they are

shown or saved by any of the following commands:

• show config

• write

• config

1 2 ... 132 133 134 135 136 137 138 139 140 141 142 ... 465 466

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 137