Cisco 500 Series, Configuration Manual

Page: 311 / 1140

16-17
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 16 Identifying Traffic with Access Lists
Adding Remarks to Access Lists
hostname(config-network)# access-list ACL_IN extended deny tcp object-group denied
object-group web eq www
hostname(config)# access-list ACL_IN extended permit ip any any
hostname(config)# access-group ACL_IN in interface inside
Displaying Object Groups
To display a list of the currently configured object groups, enter the following command:
hostname(config)# show object-group [ protocol | network | service | icmp-type | id grp_id ]
If you enter the command without any parameters, the system displays all configured object groups.
The following is sample output from the show object-group command:
hostname# show object-group
object-group network ftp_servers
description: This is a group of FTP servers
network-object host 209.165.201.3
network-object host 209.165.201.4
object-group network TrustedHosts
network-object host 209.165.201.1
network-object 192.168.1.0 255.255.255.0
group-object ftp_servers
Removing Object Groups
To remove an object group, enter one of the following commands.
Note You cannot remove an object group or make an object group empty if it is used in an access list.
•
To remove a specific object group, enter the following command:
hostname(config)# no object-group grp_id
•
To remove all object groups of the specified type, enter the following command:
hostname(config)# clear object-group [ protocol | network | services | icmp-type ]
If you do not enter a type, all object groups are removed.
Adding Remarks to Access Lists
You can include remarks about entries in any access list, including extended, EtherType, and standard
access lists. The remarks make the access list easier to understand.
To add a remark after the last access-list command you entered, enter the following command:
hostname(config)#
access-list
access_list_name
remark
text
If you enter the remark before any access-list command, then the remark is the first line in the access list.
If you delete an access list using the no access-list access_list_name command, then all the remarks are
also removed.