Reuse Object Group in a single ACL line

[johnlloyd_13]

hi,

i'm trying to configure a global ACL and reuse the same object group in a single ACL line.

i got a warning saying 'config is redundant' but when i checked, it was accepted.

my question is, can i ignore the warning and my ACL would still work? i don't want to create another object group referring to the same subnets, i.e. create an object 'CORPORATE-SUBNET-2'.

ciscoasa(config)# access-list GLOBAL_ACL extended permit object-group UDP_16384-32767 object-group CORPORATE-SUBNET object-group CORPORATE-SUBNET
WARNING: Same object-group is used more than once in one config line. This config is redundant. Please use separate object-groups
ciscoasa(config)#
ciscoasa(config)# sh run access-list GLOBAL_ACL
access-list GLOBAL_ACL extended permit object-group UDP_16384-32767 object-group CORPORATE-SUBNET object-group CORPORATE-SUBNET

[wajidhassan]

Yes — as long as the configuration is accepted, it will be applied.

• Redundancy warnings don’t prevent the ACL from functioning.

• ACL lines are still evaluated top-down, and packet matches will occur according to those rules.

[balaji.bandi]

what  is the use case, what does the group contain ? why do you need to use twice ?

you can also group them and use only one object-group.