Extended ACL with object-group network

Security
Intermediate
10 min
3 steps
Cisco IOS-style

Define an object-group network OFFICE listing two source hosts, then reference it in an extended ACL via addrgroup OFFICE. The single-place definition lets dozens of ACEs reuse the same set without copy-paste.

Open this lab in your browser →

Free · no install · no account

Scenario

Object-groups solve the "I have ten ACEs that all match the same fifteen source hosts" problem. Define the set once as an object-group network NAME, then reference it from each ACE. Updates to the set propagate to every reference. Cisco IOS object-group ACL syntax (12.4(20)T+): `` ip access-list extended FW permit ip addrgroup OFFICE any ` The addrgroup keyword is what binds the ACE to the named group. In this lab R1 has two interfaces. You'll define an object-group with two members, write an ACL referencing it, and apply the ACL inbound on Gi0/0`.

Topology

1 × router · Cisco IOS-style

R1 — router

What you will do

Define object-group network OFFICE with two members: host 10.0.0.5 and host 10.0.0.6.
Define ip access-list extended FW with permit ip addrgroup OFFICE any.
Apply FW inbound on Gi0/0: ip access-group FW in.

Open this lab in your browser →

Extended ACL with object-group network

Scenario

Topology

What you will do

More labs on this topic

This lab in other languages