Object Grouping

PIX Firewall version 6.2 introduced grouping to help reduce the complexity of configuration and to improve scalability for large or complex networks. Object Grouping allows the definition of groups, and then application of commands or features to a group. This process can reduce the number and the complexity of configuration statements and, thereby, reduce the amount of time spent configuring and troubleshooting large or complex networks.

An example of using Object Grouping would be to group objects of a similar type, so a single access list could apply to all the member objects. Review the following object groups and visualize how they might be used with ACL statements to manage network access.

• DMZServers The IP addresses of the shared servers in the DMZ network.

• Partners The host and network addresses of trading partners allowed the greatest access to the organization services and servers.

• DMZServices Those TCP/UDP port numbers and ICMP message types allowed access to the DMZ network.

An object group is created with the command mode command object-group. After the object-group command creates the group, the mode changes to a corresponding Subcommand mode. The object group is then defined in the Subcommand mode. The command prompt indicates the Active mode. The object group can neither be created empty nor removed or emptied if it’s being used by another command. Use the no form of the command to remove the group. The first line is the basic syntax to create an object group. The last two lines are the actual syntax with options.

Pix(config)# object-group object-type grp-id
Pix(config)# no object-group object-type grp-id
Pix(config)# object-group {protocol|network|icmp-type} grp-id
Pix(config)# object-group service grp-id {tcp|udp|tcp-udp}

The access-list command offers an Object Group option for each of the variable choices. The following syntax is the previous basic ACL command with an alternative to having to define each element explicitly for what could be many configurations.

Pix(config)# access-list acl_id {deny | permit}{protocol | object-type protocol-grp-id {source_addr | local_addr} {source_mask | local_mask} | object-type network-grp-id [operator port [port] | object-type service-grp-id] {dest_addr | remote_addr} {dest_mask | remote_mask} | object-type network-grp-id [operator port [port] | object-type service-grp-id]}

The following example creates a service object group to define the DMZ resources you’re willing to share. The ACL allows the Partners from the last example to use the services on the DMZ servers defined in the last example.

Pix(config)# object-group service dmz_service tcp
Pix(config-service)#port-object eq www
Pix(config-service)#port-object eq ftp
Pix(config-service)#port-object eq smtp
Pix(config-service)#exit
Pix (config)# access-list 101 permit tcp object-group partners dmz_servers eq dmz_service

An object group can contain or be contained by other object groups. For example, Partners, from the earlier example, could contain the groups AsiaPartners, EuroPartners, AfricaPartners, and NorthAmericaPartners. Each of those groups could contain other groups, such as NorthAmericaPartners might contain CanadaPartners, MexicoPartners, and USPartners. Each of the smaller subgroups only makes sense if additional resources were limited to each group. The following example demonstrates part of the previous nesting:

Pix(config)# object-group network MexicoPartners
Pix (config-network)#network-object 192.168.151.0 255.255.255.0
Pix (config-network)#network-object 192.168.159.0 255.255.255.0
Pix (config-network)#network-object 192.168.210.0 255.255.255.0
Pix(config)# object-group network CanadaPartners
Pix(config-network)# network-object 192.168.251.0 255.255.255.0
Pix(config-network)# network-object 192.168.237.0 255.255.255.0
Pix(config-network)# network-object 192.168.216.0 255.255.255.0
    (additional lines omitted)
Pix(config)# object-group network NorthAmericaPartners
Pix(config-network)# network-object CanadaPartners
Pix(config-network)# network-object MexicoPartners
Pix(config-network)# network-object USPartners
Pix(config-network)# exit
Pix(config)# access-list 101 permit tcp object-group NorthAmericaPartners any
Pix(config)# access-group 101 in interface outside

Object Grouping dramatically reduces the number of access list statements required to implement a particular security policy. The last line shows that the NorthAmericaPartners networks are allowed to have TCP access to the network.