Object Grouping
Configure object groups

This section will examine the specific commands used to configure object groups. It will focus on the first two steps of the process, which are configuring the object-group command and defining the object group in subcommand mode.

object-group Command
The first command that will be looked at is the object-group command. This command defines which type of object group will be created. The types of object groups are as follows:

  • Network groups
  • Service groups
  • Protocol groups
  • ICMP-Type groups

Once the object-group command is entered, the object group subcommand mode that corresponds to the object group type that is being used will be displayed. More information about the object group subcommands their syntax is available in the Command Reference.

Object Group Subcommands
As stated above, once the administrator has defined the type of object group that is to be created, the sub-command prompt that corresponds to that type of object group will be displayed. The items that are to be included in the object group will be defined.

For example, if a network object group is to be configured, the administrator would define a network object group. This would then take the administrator to the network object group sub-command prompt. Here the hosts and or networks that were to be part of the object group would be defined.

Alternatively, if a services object group were being used, the administrator would enter that sub-command mode and define the TCP or UDP port numbers that were to be part of the object group.


Lab Activity

Lab Exercise: Configure Service Object Groups using ASDM

In this lab, students will configure an inbound access control list (ACL) with object groups. Students will also learn to configure a service object group. Students will then configure web and ICMP access to the inside host. Finally, students will test and verify the inbound ACL.