- Table of Contents
-
- 12-Security Configuration Guide
- 00-Preface
- 01-Security zone configuration
- 02-AAA configuration
- 03-802.1X configuration
- 04-MAC authentication configuration
- 05-Portal configuration
- 06-Port security configuration
- 07-User profile configuration
- 08-Password control configuration
- 09-Keychain configuration
- 10-Public key management
- 11-PKI configuration
- 12-IPsec configuration
- 13-Group domain VPN configuration
- 14-SSH configuration
- 15-SSL configuration
- 16-SSL VPN configuration
- 17-ASPF configuration
- 18-APR configuration
- 19-mGRE configuration
- 20-Session management
- 21-Connection limit configuration
- 22-Object group configuration
- 23-Object policy configuration
- 24-Security policy configuration
- 25-Attack detection and prevention configuration
- 26-IP source guard configuration
- 27-ARP attack protection configuration
- 28-ND attack defense configuration
- 29-uRPF configuration
- 30-Crypto engine configuration
- 31-FIPS configuration
- 32-Application account auditing configuration
- Related Documents
-
Title | Size | Download |
---|---|---|
22-Object group configuration | 73.09 KB |
Contents
Restrictions and guidelines: Object group configuration
Configuring an IPv4 address object group
Configuring an IPv6 address object group
Configuring a port object group
Configuring a service object group
Configuring aging of DNS-resolved IP addresses from host names
Display and maintenance commands for object groups
Configuring object groups
About object groups
An object group is a group of objects that can be used by an ACL, object policy, or object group to identify packets. Object groups are divided into the following types:
· IPv4 address object group—A group of IPv4 address objects used to match the IPv4 address in a packet or match the user from whom a packet comes.
· IPv6 address object group—A group of IPv6 address objects used to match the IPv6 address in a packet or match the user from whom a packet comes.
· Port object group—A group of port objects used to match the protocol port number in a packet.
· Service object group—A group of service objects used to match the upper-layer service in a packet.
Restrictions and guidelines: Object group configuration
You cannot edit an object group if the group is used by a global static NAT rule.
Configuring an IPv4 address object group
1. Enter system view.
system-view
2. Create an IPv4 address object group and enter its view.
object-group ip address object-group-name
The system has one default IPv4 address object group named any.
3. (Optional.) Configure a description for the IPv4 address object group.
description text
By default, an object group does not have a description.
4. Configure an IPv4 address object.
[ object-id ] network { host { address ip-address | name host-name } | subnet ip-address { mask-length | mask | wildcard wildcard } | range ip-address1 ip-address2 | group-object object-group-name }
5. Exclude an IPv4 address or a subnet from the IPv4 address object.
object-id network exclude { ip-address | subnet ip-address { mask-length | mask } }
By default, no IPv4 address in an IPv4 address object is excluded.
Support for this command depends on the device model. For more information, see the command reference.
6. Exclude a host name from the IPv4 address object.
object-id network exclude host-name host-name
By default, no host name in an IPv4 address object is excluded.
Support for this command depends on the device model. For more information, see the command reference.
7. (Optional.) Specify a security zone for the IPv4 address object group.
security-zone security-zone-name
By default, no security zone is specified for an IPv4 address object group.
Configuring an IPv6 address object group
1. Enter system view.
system-view
2. Create an IPv6 address object group and enter its view.
object-group ipv6 address object-group-name
The system has one default IPv6 address object group named any.
3. (Optional.) Configure a description for the IPv6 address object group.
description text
By default, an object group does not have a description.
4. Configure an IPv6 address object.
[ object-id ] network { host { address ipv6-address | name host-name } | subnet ipv6-address prefix-length | range ipv6-address1 ipv6-address2 | group-object object-group-name }
5. Exclude an IPv6 address or a subnet from the IPv6 address object.
object-id network exclude { ip-address | subnet ipv6-address prefix-length }
By default, no IPv6 address in an IPv6 address object is excluded.
Support for this command depends on the device model. For more information, see the command reference.
6. Exclude a host name from the IPv6 address object.
object-id network exclude host-name host-name
By default, no host name in an IPv6 address object is excluded.
Support for this command depends on the device model. For more information, see the command reference.
7. (Optional.) Specify a security zone for the IPv6 address object group.
security-zone security-zone-name
By default, no security zone is specified for an IPv6 address object group.
Configuring a port object group
1. Enter system view.
system-view
2. Create a port object group and enter its view.
object-group port object-group-name
The system has one default port object group named any.
3. (Optional.) Configure a description for the port object group.
description text
By default, an object group does not have a description.
4. Configure a port object.
[ object-id ] port { { eq | lt | gt } port | range port1 port2 | group-object object-group-name }
Configuring a service object group
1. Enter system view.
system-view
2. Create a service object group and enter its view.
object-group service object-group-name
The system has multiple default service object groups.
3. (Optional.) Configure a description for the service object group.
description text
By default, an object group does not have a description.
4. Configure a service object.
[ object-id ] service { protocol [ { source { { eq | lt | gt } port | range port1 port2 } | destination { { eq | lt | gt } port | range port1 port2 } } * | icmp-type icmp-code | icmpv6-type icmpv6-code ] | group-object object-group-name }
Renaming an object group
1. Enter system view.
system-view
2. Rename an object group.
object-group rename old-object-group-name new-object-group-name
You can only rename non-default object groups.
Configuring aging of DNS-resolved IP addresses from host names
About this task
In load balancing scenarios where one host name maps to several IP addresses, DNS-resolved IP address for a host name changes between these mapping addresses. Upon every change, the object group module notifies relevant policies of the change, which causes policies to submit changes frequently and consumes memory. To resolve this issue, you can enable aging of DNS-resolved IP addresses from host names.
With this feature enabled, the system maintains an IP address group for each host name. If a resolved IP address is not in the group, the system adds the address to the group and notifies relevant policies of the change. If a resolved IP address is in the group, the system does not notify relevant policies and update the aging time for the resolved IP address. If an IP address in the group reaches its aging time, the system deletes it from the group and notifies relevant policies. This reduces rule matching accelerations for the relevant policies and lowers the memory usage.
Hardware and feature compatibility
Model |
Feature compatibility |
MSR610 |
No |
MSR810, MSR810-W, MSR810-W-DB, MSR810-LM, MSR810-W-LM, MSR810-10-PoE, MSR810-LM-HK, MSR810-W-LM-HK, MSR810-LM-CNDE-SJK, MSR810-CNDE-SJK, MSR810-EI, MSR810-LM-EA, MSR810-LM-EI |
Yes |
MSR810-LMS, MSR810-LUS |
Yes |
MSR810-SI, MSR810-LM-SI |
Yes |
MSR810-LMS-EA, MSR810-LME |
Yes |
MSR1004S-5G |
Yes |
MSR2600-6-X1, MSR2600-15-X1, MSR2600-15-X1-T |
Yes |
MSR2600-10-X1 |
Yes |
MSR2630 |
Yes |
MSR3600-28, MSR3600-51 |
Yes |
MSR3600-28-SI, MSR3600-51-SI |
Yes |
MSR3600-28-X1, MSR3600-28-X1-DP, MSR3600-51-X1, MSR3600-51-X1-DP |
Yes |
MSR3600-28-G-DP, MSR3600-51-G-DP |
Yes |
MSR3610-I-DP, MSR3610-IE-DP, MSR3610-IE-ES, MSR3610-IE-EAD, MSR-EAD-AK770, MSR3610-I-IG, MSR3610-IE-IG |
Yes |
MSR3610-X1, MSR3610-X1-DP, MSR3610-X1-DC, MSR3610-X1-DP-DC, MSR3620-X1, MSR3640-X1 |
Yes |
MSR3610, MSR3620, MSR3620-DP, MSR3640, MSR3660 |
Yes |
MSR3610-G, MSR3620-G |
Yes |
MSR3640-X1-HI |
Yes |
Model |
Feature compatibility |
MSR810-W-WiNet, MSR810-LM-WiNet |
Yes |
MSR830-4LM-WiNet |
Yes |
MSR830-5BEI-WiNet, MSR830-6EI-WiNet, MSR830-10BEI-WiNet |
Yes |
MSR830-6BHI-WiNet, MSR830-10BHI-WiNet |
Yes |
MSR2600-6-WiNet |
Yes |
MSR2600-10-X1-WiNet |
Yes |
MSR2630-WiNet |
Yes |
MSR3600-28-WiNet |
Yes |
MSR3610-X1-WiNet |
Yes |
MSR3610-WiNet, MSR3620-10-WiNet, MSR3620-DP-WiNet, MSR3620-WiNet, MSR3660-WiNet |
Yes |
Model |
Feature compatibility |
MSR860-6EI-XS |
Yes |
MSR860-6HI-XS |
Yes |
MSR2630-XS |
Yes |
MSR3600-28-XS |
Yes |
MSR3610-XS |
Yes |
MSR3620-XS |
Yes |
MSR3610-I-XS |
Yes |
MSR3610-IE-XS |
Yes |
MSR3620-X1-XS |
Yes |
MSR3640-XS |
Yes |
MSR3660-XS |
Yes |
Model |
Feature compatibility |
MSR810-LM-GL |
Yes |
MSR810-W-LM-GL |
Yes |
MSR830-6EI-GL |
Yes |
MSR830-10EI-GL |
Yes |
MSR830-6HI-GL |
Yes |
MSR830-10HI-GL |
Yes |
MSR1004S-5G-GL |
Yes |
MSR2600-6-X1-GL |
Yes |
MSR3600-28-SI-GL |
Yes |
Restrictions and guidelines
As a best practice, set the aging time to be longer than the TTL of resolution records on the DNS server.
Procedure
1. Enter system view.
system-view
2. Enable aging of DNS-resolved IP addresses from host names.
object-group dns-aging [ time aging-time ]
By default, aging of DNS-resolved IP addresses from host names is disabled.
Display and maintenance commands for object groups
Execute display commands in any view.
Task |
Command |
Display information about object groups. |
display object-group [ { { ip | ipv6 } address | service | port } [ default ] [ name object-group-name ] | name object-group-name ] |
Display IPv4 or IPv6 addresses for host names. |
display object-group { ip | ipv6 } host { object-group-name object-group-name | name host-name } * |