| 10.4 |  | Object Grouping |
| 10.4.2 |  | Using object groups in ACLs |

| Objects applied to ACLs ACLs have many applications. This section will examine the types of objects an ACL can be applied to. These objects include the following:

- Client host is a host that makes HTTP, Telnet, FTP, Voice over IP (VoIP), and other service requests.
- Server host is a host that responds to service requests.
- Subnet is the network address of internal or external sub-networks where server or client hosts are located.
- Service type includes services that are assigned to well known, dynamically assigned, or secondary channel TCP or UDP ports.
- ICMP types are ICMP message types, such as ECHO-REPLY.

Object group types
As was discussed earlier, object grouping provides a way to group objects of a similar type so that a single ACL can apply to all the objects in the group. There are several types of configurable object groups available to the network administrator. They include the following:

- Network - It is used to group client hosts, server hosts, or subnets.
- Protocol - It is used to group protocols. It can contain one of the keywords icmp, ip, tcp, or udp, or an integer in the range 1 to 254 representing an IP protocol number. To match any Internet protocol, including ICMP, TCP, and UDP, use the keyword ip.
- Service - It is used to group TCP or UDP port numbers assigned to a different service.
- ICMP type - It is used to group ICMP message types that permit or deny access.

Example: Using object groups in ACLs
Figure shows the following three object groups, two of which are Network groups and one of which is a Protocol group.

- SERVERS - A Network group that includes the IP addresses of outside hosts to which access is allowed.
- CLIENTS - A Network group that includes the addresses of inside hosts and networks that are allowed to access the servers.
- MYPROTOCOLS - A Protocol group that includes the protocols the clients are allowed to use.

As illustrated by Figure , multiple object groups can be applied to a single ACL. Using the three groups shown in the figure, which are CLIENTS, SERVERS, and MYPROTOCOLS, the number of ACL entries needed for enabling all the clients to access both of the servers with both TCP and ICMP is dramatically reduced. Without object groups, it would have required that all of the original access-list ACLOUT entries be included. By using object groups, they are reduced to a single ACL entry.

Now that object groups have been discussed, look at how they are configured. Demonstration activity 10.4.2 looks at the process related to configuring object groups. Later sections will then examine the specific configuration commands needed to configure the following different types of object groups:

- Network
- Service
- ICMP
- Protocol

| Media Activity Demonstration Activity: 7 Step Process to Configure ACLs with Object Groups In this activity, students will learn the process of configuring and applying access groups.