Login
- Table of Contents
-
- 16-Security Configuration Guide
- 00-Preface
- 01-ACL configuration
- 02-Packet filter configuration
- 03-Time range configuration
- 04-User profile configuration
- 05-Password control configuration
- 06-Keychain configuration
- 07-Public key management
- 08-PKI configuration
- 09-IPsec configuration
- 10-IKE configuration
- 11-IKEv2 configuration
- 12-SSH configuration
- 13-SSL configuration
- 14-SSL VPN configuration
- 15-Session management
- 16-Connection limit configuration
- 17-Attack detection and prevention configuration
- 18-IP-based attack prevention configuration
- 19-IP source guard configuration
- 20-ARP attack protection configuration
- 21-ND attack defense configuration
- 22-Protocol packet rate limit configuration
- 23-Security policy configuration
- 24-Object group configuration
- 25-ASPF configuration
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 24-Object group configuration | 70.22 KB |
Contents
Configuring a MAC address object group
Configuring an IPv4 address object group
Configuring an IPv6 address object group
Configuring a port object group
Configuring a service object group
Verifying and maintaining object groups
Configuring object groups
About object groups
An object group is a group of objects that can be used by an ACL, object policy, or object group to identify packets. Object groups are divided into the following types:
· MAC address object group—A group of MAC address objects used to match the MAC address in a packet.
· IPv4 address object group—A group of IPv4 address objects used to match the IPv4 address in a packet or match the user from whom a packet comes.
· IPv6 address object group—A group of IPv6 address objects used to match the IPv6 address in a packet or match the user from whom a packet comes.
· Port object group—A group of port objects used to match the protocol port number in a packet.
· Service object group—A group of service objects used to match the upper-layer service in a packet.
Configuring a MAC address object group
1. Enter system view.
system-view
2. Create a MAC address object group and enter its view.
object-group mac-address object-group-name
The system has one default IPv4 address object group named any.
3. (Optional.) Configure a description for the MAC address object group.
description text
By default, an object group does not have a description.
4. Configure a MAC address object.
[ object-id ] mac { mac-address | group-object group-object-name }
Configuring an IPv4 address object group
1. Enter system view.
system-view
2. Create an IPv4 address object group and enter its view.
object-group ip address object-group-name
The system has one default IPv4 address object group named any.
3. (Optional.) Configure a description for the IPv4 address object group.
description text
By default, an object group does not have a description.
4. Configure an IPv4 address object.
[ object-id ] network { host { address ip-address | name host-name } | subnet ip-address { mask-length | mask | wildcard wildcard } | range ip-address1 ip-address2 | group-object object-group-name }
5. Exclude an IPv4 address or a subnet from the IPv4 address object.
object-id network exclude ip-address
By default, no IPv4 address in an IPv4 address object is excluded.
Configuring an IPv6 address object group
1. Enter system view.
system-view
2. Create an IPv6 address object group and enter its view.
object-group ipv6 address object-group-name
The system has one default IPv6 address object group named any.
3. (Optional.) Configure a description for the IPv6 address object group.
description text
By default, an object group does not have a description.
4. Configure an IPv6 address object.
[ object-id ] network { host { address ipv6-address | name host-name } | subnet ipv6-address prefix-length | range ipv6-address1 ipv6-address2 | group-object object-group-name }
5. Exclude an IPv6 address or a subnet from the IPv6 address object.
object-id network exclude ip-address
By default, no IPv6 address in an IPv6 address object is excluded.
Configuring a port object group
1. Enter system view.
system-view
2. Create a port object group and enter its view.
object-group port object-group-name
The system has one default port object group named any.
3. (Optional.) Configure a description for the port object group.
description text
By default, an object group does not have a description.
4. Configure a port object.
[ object-id ] port { { eq | lt | gt } port | range port1 port2 | group-object object-group-name }
Configuring a service object group
1. Enter system view.
system-view
2. Create a service object group and enter its view.
object-group service object-group-name
The system has multiple default service object groups.
3. (Optional.) Configure a description for the service object group.
description text
By default, an object group does not have a description.
4. Configure a service object.
[ object-id ] service { protocol [ { source { { eq | lt | gt } port | range port1 port2 } | destination { { eq | lt | gt } port | range port1 port2 } } * | icmp-type icmp-code | icmpv6-type icmpv6-code ] | group-object object-group-name }
Renaming an object group
1. Enter system view.
system-view
2. Rename an object group.
object-group rename old-object-group-name new-object-group-name
You can only rename non-default object groups.
Verifying and maintaining object groups
Perform display tasks in any view.
· Display information about object groups.
display object-group [ { { ip | ipv6 } address | mac-address | service | port } [ default ] [ name object-group-name ] | name object-group-name ]
· Display IPv4 or IPv6 addresses for host names.
display object-group { ip | ipv6 } host { object-group-name object-group-name | name host-name } * [ ap name ap-name ]
