Object Group Configuration Example

Object Group Configuration Example

To help illustrate the use of object groups with ACLs, I’ll use the network shown in
Figure . In this example, I will allow outside access to the internal servers, but only for
web and FTP access to the specific servers.

ciscoasa(config)# global (outside) 1 200.200.200.1

netmask 255.255.255.0

ciscoasa(config)# nat (inside) 1 0.0.0.0 0.0.0.0

ciscoasa(config)# static (inside,outside) 200.200.200.2 192.168.1.2

ciscoasa(config)# static (inside,outside) 200.200.200.3 192.168.1.3

ciscoasa(config)# static (inside,outside) 200.200.200.4 192.168.1.4

ciscoasa(config)# static (inside,outside) 200.200.200.5 192.168.1.5

ciscoasa(config)# static (inside,outside) 200.200.200.6 192.168.1.6

ciscoasa(config)#

ciscoasa(config)# object-group network web_servers

ciscoasa(config-network)# network-object host 200.200.200.2

ciscoasa(config-network)# network-object host 200.200.200.3

ciscoasa(config-network)# network-object host 200.200.200.4

ciscoasa(config-network)# exit

ciscoasa(config)# object-group network ftp_servers

ciscoasa(config-network)# network-object host 200.200.200.4

ciscoasa(config-network)# network-object host 200.200.200.5

ciscoasa(config-network)# network-object host 200.200.200.6

ciscoasa(config-network)# exit

ciscoasa(config)# access-list PERMIT_IN permit tcp

any object-group web_servers eq 80

ciscoasa(config)# access-list PERMIT_IN permit tcp

any object-group ftp_servers eq 21

ciscoasa(config)# access-list PERMIT_IN deny ip any any

ciscoasa(config)# access-group PERMIT_IN in interface outside

Two network object groups are here, one for web servers and one for FTP servers. Two ACL statements allow access to these web servers and FTP servers, but deny everything else.
If you didn’t use object groups, you would need six statements for the servers and then the deny ip any any if you wanted to view the hit counts of all dropped packets.