Cisco PIX 525 Especificaciones descargar pdf (Pagina 136)

3-24

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 3 Controlling Network Access and Use

Simplifying Access Control with Object Grouping

This section describes how to use object grouping, a feature introduced in PIX Firewall Version 6.2, for

simplifying complex access control policies. It includes the following topics:

• How Object Grouping Works, page 3-24

• Using Subcommand Mode, page 3-25

• Configuring and Using Object Groups with Access Control, page 3-26

• Configuring Protocol Object Groups, page 3-28

• Configuring Network Object Groups, page 3-28

• Configuring Service Object Groups, page 3-28

• Configuring ICMP-Type Object Groups, page 3-29

• Nesting Object Groups, page 3-29

• Displaying Configured Object Groups, page 3-30

• Removing Object Groups, page 3-30

How Object Grouping Works

Object grouping provides a way to reduce the number of access rules required to describe complex

security policies. An access rule can apply to the following types of objects:

• Client host—Makes HTTP, Telnet, FTP, Voice over IP, and other service requests

• Server host—Responds to service requests

• Service type—Services are assigned to well-known, dynamically assigned, or secondary channel

TCP or UDP ports

• Subnet—The network address of internal or external subnetworks where server or client hosts are

located

• ICMP types—Such as ECHO-REPLY

An access rule allows or denies traffic matching a specific combination of these objects. For example,

an access rule might cause the PIX

Firewall to allow a designated client to access a particular server host

for a specific service. When there is only one client, one host, and one service, only one access rule is

needed. However, as the number of clients, servers, and services increases, the number of rules required

may increase exponentially.

Object grouping provides a way to group objects of a similar type into a group so that a single access

rule can apply to all the objects in the group. For example, consider the following three object groups:

• MyServices—Includes the TCP/UDP port numbers of the service requests that are allowed access

to the internal network

• TrustedHosts—Includes the host and network addresses allowed access to the greatest range of

services and servers

• PublicServers—Includes the host addresses of servers to which the greatest access is provided

1 2 ... 131 132 133 134 135 136 137 138 139 140 141 ... 465 466

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 136