Cisco PIX 525 Especificações descarregar pdf (Página 141)

3-29

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 3 Controlling Network Access and Use

Simplifying Access Control with Object Grouping

Enter the following command to add a single TCP or UDP port number to the service object group:

pix(config-service)# port-object eq service grp-id

Enter the following command to add a range of TCP or UDP port numbers to the service object group:

pix(config-service)# port-object range begin_service end_service

Enter the following command to add the object group identified by grp-id to the current service object

group:

pix(config-service)# group-object grp-id

Configuring ICMP-Type Object Groups

This section describes the commands required to configure an icmp-type object group.

Enter the following command to enable the icmp-type object subcommand mode:

pix(config)# object-group icmp-type grp-id

Enter the following command to add an ICMP type to the service object group:

pix(config-icmp-type)# icmp-object icmp-type

Replace icmp-type with a numeric value. Refer to the access-list command in the Cisco PIX Firewall

Command Reference for a definition of the permitted values.

Enter the following command to add the object group identified by grp-id to the current icmp-type object

group:

pix(config-icmp-type)# group-object grp-id

Nesting Object Groups

The object-group command allows logical grouping of the same type of objects and construction of

hierarchical object groups for structured configuration. To nest an object group within another object

group, perform the following steps:

Step 1 Assign a group ID to the object group that you want to nest within another object group, as in the

following example:

pix(config)# object-group protocol Group_A

Step 2 Add the appropriate type of objects to the object group:

pix(config-protocol)# protocol-object 1

pix(config-protocol)# protocol-object 2

pix(config-protocol)# protocol-object 3

Step 3 Assign a group identifier to the object group within which you want to nest another object group:

pix(config)# object-group protocol Group_B

1 2 ... 136 137 138 139 140 141 142 143 144 145 146 ... 465 466

Sem comentários

Cisco PIX 525 Especificações Página 141