Cisco Catalyst 4500 Series, Software Configuration Manual

Page: 1664 / 2086

62-40
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 62 Configuring Network Security with ACLs
Configuring Object Group ACLs
You can add, delete, or change objects in an object group membership list dynamically (without deleting
and redefining the object group), and without redefining the ACL ACE that uses the object group.
When you add a member to a group, delete a member from a group, or modify the policy statements in
an ACE that uses an access group, the system updates the ACEs in the TCAM. An ACE that is defined
using a group name, is equivalent to multiple ACEs (one applied to each entry in the object group). The
system expands the object group ACL ACEs into multiple Cisco IOS ACEs (one ACE for each entry in
the group) and populates the ACEs in the TCAM. Therefore, the object group ACL feature reduces the
number of entries you need to configure but does not reduce TCAM usage.
You cannot delete an object group that is used within an ACL or a class-based policy language (CPL)
policy.
Configuring IPv4 OG ACLs
• Guidelines and Restrictions for Configuring IPv4 OG ACLs, page 62-40
•
Creating a Network Object Group, page 62-40
• Creating a Service Object Group, page 62-42
•
Configuring an IPv4 OG ACL, page 62-43
• Applying an IPv4 OG ACL to an Interface, page 62-44
•
Verifying IPv4 OG ACLs, page 62-45
Guidelines and Restrictions for Configuring IPv4 OG ACLs
•
The object groups can be used only in extended named and numbered ACLs.
•
IPv4 OG ACLs support only Layer 3 interfaces (such as routed interfaces and VLAN interfaces).
They do not support Layer 2 features such as VLAN ACLs (VACLs) or port ACLs (PACLs).
• IPv4 OG ACLs are not supported with IPsec.
•
IPv4 OG ACLs are not supported on management interfaces, such as FastEthernet1, and on GRE
tunnels.
• The maximum number of object group-based ACEs supported in an ACL is 2048.
Creating a Network Object Group
To create a network object group, perform this task:
Command or Action Purpose
Step 1
configure terminal
Example:
Switch# configure terminal
Enters global configuration mode.
Step 2 object-group network object-group-name
Example:
Switch(config)# object-group network
my-network-object-group
Defines the object group name and enters network
object-group configuration mode.