Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 138)

3-26

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 3 Controlling Network Access and Use

Simplifying Access Control with Object Grouping

Configuring and Using Object Groups with Access Control

To configure an object group and to use it for configuring access lists, perform the following steps:

Step 1 Enter the appropriate subcommand mode for the type of group you want to configure.

The syntax of the object-group command is as follows:

pix(config)# object-group {protocol|network|icmp-type} grp-id

pix(config)# object-group service grp-id {tcp|udp|tcp-udp}

Use the first parameter to identify the type of object group you want to configure. Replace the second

parameter grp-id with a descriptive name for the group. When you enter the object-group command, the

system enters the appropriate subcommand mode for the type of object you are configuring.

For example, the following command identifies an object group containing trusted hosts:

pix(config)# object-group network TrustedHosts

When you enter this command, the system enters the network object subcommand mode and the

PIX

Firewall system prompt appears as follows:

pix(config-network)#

All subcommands entered from this prompt apply to the object group identified by the object-group

command. In this example, the object group name is TrustedHosts.

Step 2 Define the members of the object group.

Use the subcommands permitted within the subcommand mode to define members of the object group.

Use the group-object subcommand to add a su/jointfilesconvert/354787/bgroup within the current object group.

For example:

pix(config)# object-group network ftp_servers

pix(config-network)# network-object host 209.165.201.3

pix(config-network)# network-object host 209.165.201.4

pix(config-network)# exit

pix(config)# object-group network TrustedHosts

pix(config-network)# network-object host sjc.eng.ftp

pix(config-network)# network-object host 209.165.201.1

pix(config-network)# network-object 192.168.1.0 255.255.255.0

pix(config-network)# group-object ftp_servers

These commands add the following objects to the group TrustedHosts:

• One host by host name

• One host by network address

• One subnetwork

• One su/jointfilesconvert/354787/bgroup (ftp_servers)

Step 3 (Optional) Describe the object group by entering the following command from the subcommand mode:

pix(config-network)# description text

This command lets you add a description of up to 200 characters to an object group. Replace text with

the descriptive information you wish to enter.

Step 4 Return to configuration mode by entering the following command:

pix(config-network)# exit

1 2 ... 133 134 135 136 137 138 139 140 141 142 143 ... 465 466

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 138

Komentarze do niniejszej Instrukcji

Powiązane produkty i podręczniki dla Systemy kontroli dostępu bezpieczeństwa Cisco PIX 525