PIX object-groups and access-lists question.

svuorilehto — Fri, 21 Feb 2020 07:23:45 GMT

Hi all,

First, I apologize if this issue have been discussed earlier.

I have a PIX with dozens of access-list statements. I would like to simplify this list by using object-groups. F.ex:

In acl I have:

access-list acl-out permit icmp any any echo-reply

access-list acl-out permit icmp any any time-exceeded

access-list acl-out permit icmp any any unreachable

Now when I create object-group for permitted icmp-types:

object-group icmp-type icmp-permitted

icmp-object echo-reply

icmp-object time-exceeded

icmp-object unreachable

And then add a line to my acl:

access-list acl-out permit icmp any any object-group icmp-permitted

Now this does not remove previously configured lines from my config...

So question is; is there some way to do this so that when I create object-group and add it to my acl all previously configured lines which are covered by this new line would be removed?

Thanks in advance,

Saska

Re: PIX object-groups and access-lists question.

jsivulka — Wed, 19 May 2004 13:41:09 GMT

I guess, manually removing the earlier statements is the only way. I do not remember hearing of a mechanism where redundant ststements are removed automatically.

topic PIX object-groups and access-lists question. in Network Security

PIX object-groups and access-lists question.

Re: PIX object-groups and access-lists question.