This section will examine the specific commands used to configure object
groups. It will focus on the first two steps of the process, which are
configuring the object-group command and defining the
object group in subcommand mode.
object-group
Command The first command that will be looked at is the
object-group command. This command defines which type of
object group will be created. The types of object groups are as follows:
Network groups
Service groups
Protocol groups
ICMP-Type groups
Once the object-group command is entered, the
object group subcommand mode that corresponds to the object group type that is
being used will be displayed. More information about the object group
subcommands their syntax is available in the Command Reference.
Object
Group Subcommands As stated above, once the administrator has defined
the type of object group that is to be created, the sub-command prompt that
corresponds to that type of object group will be displayed. The items that are
to be included in the object group will be defined.
For example, if a
network object group is to be configured, the administrator would define a
network object group. This would then take the administrator to the network
object group sub-command prompt. Here the hosts and or networks that were to be
part of the object group would be defined.
Alternatively, if a services
object group were being used, the administrator would enter that sub-command
mode and define the TCP or UDP port numbers that were to be part of the object
group.
Lab
Exercise: Configure Service Object Groups using ASDM
In this lab,
students will configure an inbound access control list (ACL) with object
groups. Students will also learn to configure a service object group. Students
will then configure web and ICMP access to the inside host. Finally, students
will test and verify the inbound ACL.