I'm looking for ways to make editing ACL on my 3560-x Catalyst switches a lot easier. It's about 200+ lines. I think using Object Network Groups similar to ASA firewalls will be helpful.
I found this link but I don't think it's supported on Catalyst:
Any recommendations?
Solved! Go to Solution.
Object group feature is not supported on 3560 and 3750 switches. Please refer
https://supportforums.cisco.com/discussion/11119341/object-group-c3560-c3750-switches
Hi Marc
Yes you can use object-group in Switches and Routers like we do in ASA, to be honest not sure if all the switches support object-groups but you can try with the following config, the sintaxis is different than the firewalls.
Please let me prepare an example.
Example:
object-group ip port HTTP-PORT <-- object group for services
eq 80
object-group ip address SOURCE
host-info 172.17.2.5 <--- For a host /32
172.17.10.0 255.255.255.0 <--- network
ip access-list extended OUTBOUND-TRAFFIC
permit tcp addrgroup SOURCE any portgroup HTTP-PORT
The command addrgroup is used for the data groups like SOURCE and the portgroup is used for TCP/UDP ports.
I have used object-groups with Vlan ACL (VACL), if you are going to use object-group keep monitoring the CPU in order to verify if it is increased.
Please rate the comment if it is useful
:-)
Object group feature is not supported on 3560 and 3750 switches. Please refer
https://supportforums.cisco.com/discussion/11119341/object-group-c3560-c3750-switches
Thanks for confirming. This is also what I thought.
Any similar commands I can use on switches? My objective is trying to prevent so many lines on my ACL and make it easier to read.