| 10.4 |  | Object Grouping |
| 10.4.1 |  | Grouping objects of similar types |

| Overview of object groups An ACL can cause the PIX Security Appliance to allow a designated client to access a particular server for a specific service. When there is only one client, one host, and one service, only one ACL is needed. However, as the number of clients, servers, and services increases, the number of ACLs required may increase exponentially.

To simplify the task of creating and applying ACLs, administrators can group network objects such as hosts, and services such as FTP and HTTP. This reduces the number of ACLs required to implement complex security policies. For example, a security policy that normally requires 3300 ACLs might only require 40 ACLs after hosts and services are properly grouped.

Applying an object group to the PIX Security Appliance
Applying a PIX object group to a PIX Security Appliance command is the equivalent of applying every element of the object group to the command. For example, the group CLIENTS contains host 10.0.1.11, host 10.0.2.11, and network 10.0.0.0/24.

Applying the group CLIENTS to an ACL is the same as applying both hosts and the network to the ACL. Therefore, the command

> access-list ACLOUT permit tcp object-group CLIENTS any

is equivalent to the following:

> access-list ACLOUT permit tcp host 10.0.1.11 any

> access-list ACLOUT permit tcp host 10.0.2.11 any

> access-list ACLOUT permit tcp 10.0.0.0 255.255.255.0 any