| 10.4 |  | Object Grouping |
| 10.4.4 |  | Applying ACLs to object groups |

| Object groups are created in order to simplify the process of creating access control lists. It is therefore important for an administrator to understand how to apply ACLs to object groups once those object groups have been created. To do this, the administrator replaces the parameters of the access list commands with the corresponding object group. This is summarized for each type of object group as follows :

- Replace the protocol parameter with one Protocol object group preceded by the keyword object-group.
- Replace the local IP address and subnet mask with one Network object group preceded by the keyword object-group.
- Replace the remote IP address and subnet mask with one Network object group preceded by the keyword object-group.
- Replace the port parameter with one Service object group preceded by the keyword object-group.
- Replace the icmp-type parameter with one ICMP-Type object group preceded by the keyword object-group.

The Command Reference illustrates how to apply ACLs to object groups, and explains the syntax of the command.

| Lab Activity Lab Exercise: Configure Object Groups In this lab example, protocols, remotes, locals, and services are previously defined object group names. Object groups can also be nested, where one object group can be included as a subset of another object group.