Cisco Object Groups for ACLs: Руководство по настройке и использованию (EN)

Restrictions for Object Groups for ACLs

Object Groups for ACLs The Object Groups for ACLs feature lets you classify users, devices, or protocols into groups and apply those groups to access control lists (ACLs) to create access control policies for those groups. This feature lets you use object groups instead of individual IP addresses, protocols, and ports, which are used in conventional ACLs. This feature allows multiple access control entries (ACEs), but now you can use each ACE to allow an entire group of users to access a group of servers or services or to deny them from doing so.

In large networks, the number of ACLs can be large (hundreds of lines) and difficult to configure and manage, especially if the ACLs frequently change. Object group-based ACLs are smaller, more readable, and easier to configure and manage than conventional ACLs, simplifying static and dynamic ACL deployments for large user access environments on Cisco IOS routers. Cisco IOS Firewall benefits from object groups, because they simplify policy creation (for example, group A has access to group A services).

Restrictions for Object Groups for ACLs, on page 1 Information About Object Groups for ACLs, on page 2 How to Configure Object Groups for ACLs, on page 3 Configuration Examples for Object Groups for ACLs, on page 11 Additional References for Object Groups for ACLs, on page 13 Feature History for Object Groups for ACLs, on page 14 Restrictions for Object Groups for ACLs • You can use object groups only in extended named and numbered ACLs. • Object group-based ACLs support only IPv4 or IPv6 addresses. • Object group-based ACLs support only Layer 3 interfaces (such as routed interfaces and VLAN interfaces) and sub-interfaces. • Object group-based ACLs are not supported with IPsec.

• ACL statements using object groups will be ignored on packets that are sent to RP for processing. • The number of object group-based ACEs supported in an ACL varies depending on platform, subject to TCAM availability. log and log-input options of the deny and permit commands in extended access-list configuration mode are configurable via the CLI but these options are not supported. Object Groups for ACLs 1

Стр. 1

Objects Allowed in Network Object Groups

Information About Object Groups for ACLs You can configure conventional ACEs and ACEs that refer to object groups in the same ACL. You can use object group-based ACLs with quality of service (QoS) match criteria, Cisco IOS Firewall, Dynamic Host Configuration Protocol (DHCP), and any other features that use extended ACLs. In addition, you can use object group-based ACLs with multicast traffic. When there are many inbound and outbound packets, using object group-based ACLs increases performance when compared to conventional ACLs.

Also, in large configurations, this feature reduces the storage needed in NVRAM, because using object groups in ACEs means that you do not need to define an individual ACE for every address and protocol pairing. Object Groups An object group can contain a single object (such as a single IP address, network, or subnet) or multiple objects (such as a combination of multiple IP addresses, networks, or subnets). A typical access control entry (ACE) allows a group of users to have access only to a specific group of servers.

In an object group-based access control list (ACL), you can create a single ACE that uses an object group name instead of creating many ACEs (which requires each ACE to have a different IP address). A similar object group (such as a protocol port group) can be extended to provide access only to a set of applications for a user group. ACEs can have object groups for the source only, destination only, none, or both. You can use object groups to separate the ownership of the components of an ACE. For example, each department in an organization controls its group membership, and the administrator owns the ACE itself to control which departments can contact one another.

You can use object groups in features that use Cisco Policy Language (CPL) class maps. This feature supports two types of object groups for grouping ACL parameters: network object groups and service object groups. Use these object groups to group IP addresses, protocols, protocol services (ports), and Internet Control Message Protocol (ICMP) types. Objects Allowed in Network Object Groups A network object group is a group of any of the following objects:

• Any IP address—includes a range from 0.0.0.0 to 255.255.255.255 (This is specified using the any command.) • Host IP addresses • Hostnames • Other network object groups • Subnets • Host IP addresses • Network address of group members • Nested object groups Object Groups for ACLs Information About Object Groups for ACLs Object Groups for ACLs 2

Стр. 2

Creating a Network Object Group

Objects Allowed in Service Object Groups A service object group is a group of any of the following objects: • Source and destination protocol ports (such as Telnet or Simple Network Management Protocol [SNMP]) • Internet Control Message Protocol (ICMP) types (such as echo, echo-reply, or host-unreachable) • Top-level protocols (such as Encapsulating Security Payload [ESP], TCP, or UDP) • Other service object groups ACLs Based on Object Groups All features that use or reference conventional access control lists (ACLs) are compatible with object-group-based ACLs, and the feature interactions for conventional ACLs are the same with object-group-based ACLs.

This feature extends the conventional ACLs to support object-group-based ACLs and also adds new keywords and the source and destination addresses and ports. You can add, delete, or change objects in an object group membership list dynamically (without deleting and redefining the object group). Also, you can add, delete, or change objects in an object group membership list without redefining the ACL access control entry (ACE) that uses the object group. You can add objects to groups, delete them from groups, and then ensure that changes are correctly functioning within the object-group-based ACL without reapplying the ACL to the interface.

You can configure an object-group-based ACL multiple times with a source group only, a destination group only, or both source and destination groups. You cannot delete an object group that is used within an ACL or a class-based policy language (CPL) policy. How to Configure Object Groups for ACLs To configure object groups for ACLs, you first create one or more object groups. These can be any combination of network object groups (groups that contain objects such as, host addresses and network addresses) or service object groups (which use operators such as lt , eq , gt , neq , and range with port numbers).

Then, you create access control entries (ACEs) that apply a policy (such as permit or deny ) to those object groups. Creating a Network Object Group A network object group that contains a single object (such as a single IP address, a hostname, another network object group, or a subnet) or multiple objects with a network object-group-based ACL to create access control policies for the objects. Perform this task to create a network object group. Procedure Object Groups for ACLs Objects Allowed in Service Object Groups Command or Action Purpose Step 1 enable Example: Enables privileged EXEC mode. Enter your password, if prompted. Object Groups for ACLs 3

Стр. 3

Creating a Network Object Group

Object Groups for ACLs Creating a Network Object Group Command or Action Purpose Device> enable Step 2 configure terminal Example: Device# configure terminal Enters global configuration mode. Step 3 object-group network object-group-name Example: Device(config)# object-group network my-network-object-group Defines the object group name and enters network object-group configuration mode. Step 4 description description-text Example: Device(config-network-group)# description test engineers (Optional) Specifies a description of the object group. • You can use up to 200 characters. Step 5 host {host-address | host-name} Example:

Device(config-network-group)# host 209.165.200.237 (Optional) Specifies the IP address or name of a host. • If you specify a host address, you must use an IPv4 address. Step 6 network-address {/nn | network-mask} Example: Device(config-network-group)# 209.165.200.225 255.255.255.224 (Optional) Specifies a subnet object. • You must specify an IPv4 address for the network address. The default network mask is 255.255.255.255. Step 7 group-object nested-object-group-name Example: Device(config-network-group)# group-object my-nested-object-group (Optional) Specifies a nested (child) object group to be included in the current (parent) object group.

• The type of child object group must match that of the parent (for example, if you are creating a network object group, you must specify another network object group as the child). • You can use duplicated objects in an object group only via nesting of group objects. For example, if object 1 is in both group A and group B, you can define a group C that includes both A and B. However, you cannot include a group object that causes the group hierarchy to become circular (for example, you cannot include group A in group B and then also include group B in group A). Object Groups for ACLs 4

Стр. 4