Contents

Configuring object groups· 1

About object groups· 1

Configuring an IPv4 address object group· 1

Configuring an IPv6 address object group· 1

Configuring a port object group· 2

Display and maintenance commands for object groups· 2

Configuring object groups

About object groups

An object group is a group of objects that can be used by an ACL or object group to identify packets. Object groups are divided into the following types:

·     IPv4 address object group—A group of IPv4 address objects used to match the IPv4 address in a packet.

·     IPv6 address object group—A group of IPv6 address objects used to match the IPv6 address in a packet.

·     Port object group—A group of port objects used to match the protocol port number in a packet.

Configuring an IPv4 address object group

Restrictions and guidelines

When you use the group-object object-group-name option, follow these guidelines:

·     The object group to be used must be an IPv4 address object group.

·     Two object groups cannot use each other at the same time.

·     The system supports a maximum of two object group hierarchy layers and contents of used groups cannot be the same. For example, if object group ipgroup contains subnet 10.1.1.0 255.255.255.0 and group object ipgroup1, and object group ipgroup1 also contains 10.1.1.0 255.255.255.0, the packet filter that uses object group ipgroup will fail to be deployed.

Procedure

1.     Enter system view.

system-view

2.     Configure an IPv4 address object group and enter its view.

object-group ip address object-group-name

The system has one default IPv4 address object group named any.

3.     (Optional.) Configure a description for the IPv4 address object group.

description text

By default, an object group does not have a description.

4.     Configure an IPv4 address object.

[ object-id ] network { host { address ip-address | name host-name } | subnet ip-address { mask-length | mask }| group-object object-group-name }

Configuring an IPv6 address object group

Restrictions and guidelines

When you use the group-object object-group-name option, follow these guidelines:

·     The object group to be used must be an IPv6 address object group.

·     Two object groups cannot use each other at the same time.

·     The system supports a maximum of two object group hierarchy layers and contents of used groups cannot be the same. For example, if object group ipv6group contains subnet 1:1:1::1 24 and group object ipv6group1, and object group ipv6group1 also contains 1:1:1::1 24, the packet filter that uses object group ipv6group will fail to be deployed.

Procedure

1.     Enter system view.

system-view

2.     Configure an IPv6 address object group and enter its view.

object-group ipv6 address object-group-name

The system has one default IPv6 address object group named any.

3.     (Optional.) Configure a description for the IPv6 address object group.

description text

By default, an object group does not have a description.

4.     Configure an IPv6 address object.

[ object-id ] network { host { address ipv6-address | name host-name } | subnet ipv6-address prefix-length | group-object object-group-name}

Configuring a port object group

Restrictions and guidelines

·     Two object groups cannot use each other at the same time.

·     The system supports a maximum of two object group hierarchy layers and contents of used object groups cannot be the same. For example, if object group portgroup contains port eq 100 and object group portgroup1, and object group portgroup1 also contains port eq 100, the packet filter that uses object group portgroup will fail to be deployed.

Precedure

1.     Enter system view.

system-view

2.     Configure a port object group and enter its view.

object-group port object-group-name

The system has one default port object group named any.

3.     (Optional.) Configure a description for the port object group.

description text

By default, an object group does not have a description.

4.     Configure a port object.

[ object-id ] port { { eq | lt | gt } port | range port1 port2 | group-object object-group-name }

Display and maintenance commands for object groups

Execute display commands in any view.

‌