Contents

Configuring object groups· 1

About object groups· 1

Configuring an IPv4 address object group· 1

Configuring an IPv6 address object group· 1

Configuring a port object group· 2

Configuring aging of DNS-resolved IP addresses from host names· 2

Display and maintenance commands for object groups· 2

Configuring object groups

About object groups

An object group is a group of objects that can be used by an ACL or object group to identify packets. Object groups are divided into the following types:

·     IPv4 address object group—A group of IPv4 address objects used to match the IPv4 address in a packet or match the user from whom a packet comes.

·     IPv6 address object group—A group of IPv6 address objects used to match the IPv6 address in a packet or match the user from whom a packet comes.

·     Port object group—A group of port objects used to match the protocol port number in a packet.

Configuring an IPv4 address object group

1.     Enter system view.

system-view

2.     Configure an IPv4 address object group and enter its view.

object-group ip address object-group-name

The system has one default IPv4 address object group named any.

3.     (Optional.) Configure a description for the IPv4 address object group.

description text

By default, an object group does not have a description.

4.     Configure an IPv4 address object.

[ object-id ] network { host { address ip-address | name host-name [ vpn-instance vpn-instance-name ] } | subnet ip-address { mask-length | mask } | range ip-address1 ip-address2 }

Configuring an IPv6 address object group

1.     Enter system view.

system-view

2.     Configure an IPv6 address object group and enter its view.

object-group ipv6 address object-group-name

The system has one default IPv6 address object group named any.

3.     (Optional.) Configure a description for the IPv6 address object group.

description text

By default, an object group does not have a description.

4.     Configure an IPv6 address object.

[ object-id ] network { host { address ipv6-address | name host-name [ vpn-instance vpn-instance-name ] } | subnet ipv6-address prefix-length | range ipv6-address1 ipv6-address2 }

Configuring a port object group

1.     Enter system view.

system-view

2.     Configure a port object group and enter its view.

object-group port object-group-name

The system has one default port object group named any.

3.     (Optional.) Configure a description for the port object group.

description text

By default, an object group does not have a description.

4.     Configure a port object.

[ object-id ] port { { eq | lt | gt } port | range port1 port2 | }

Configuring aging of DNS-resolved IP addresses from host names

About this task

In load balancing scenarios where one host name maps to several IP addresses, DNS-resolved IP address for a host name changes between these mapping addresses. Upon every change, the object group module notifies relevant policies of the change, which causes policies to submit changes frequently and consumes memory. To resolve this issue, you can enable aging of DNS-resolved IP addresses from host names.

With this feature enabled, the system maintains an IP address group for each host name. If a resolved IP address is not in the group, the system adds the address to the group and notifies relevant policies of the change. If a resolved IP address is in the group, the system does not notify relevant policies.

Restrictions and guidelines

As a best practice, set the aging time to be longer than the TTL of resolution records on the DNS server.

Procedure

1.     Enter system view.

system-view

2.     Enable aging of DNS-resolved IP addresses from host names.

object-group dns-aging [ time aging-time ]

By default, aging of DNS-resolved IP addresses from host names is disabled.

Display and maintenance commands for object groups

Execute display commands in any view.