ort-object eq ssh port-object eq domain port-object eq smtp port-object eq imap4 object-group service Webserver-svcs-udp udp description Webserver UDP Services > ] port-object eq domain object-group network Webservers description Webservers > ] network-object host gto network-object host meg object-group icmp-type ICMP-Types description [ < Allowed ICMP Types > ] icmp-object unreachable icmp-object time-exceeded icmp-object echo-reply Now that I've organized all the services and servers into groups, it's time to rewrite the access list to use them: access-list Inbound permit udp any object-group Webservers object-group Webserver- svcs-udp access-list Inbound permit tcp any object-group Webservers object-group Webserver- access-list Inbound permit tcp any host lab eq telnet access-list Inbound permit tcp any host lab object-group CCIE-Rack Chapter 25: Access Lists access-list Inbound permit udp any host ASA-Outside eq 5060 access-list Inbound permit tcp any host lab eq 8080 access-list Inbound permit esp any any access-list Inbound permit icmp any any object-group ICMP-Types The access list has gone from 18 lines down to 8. This is only the visible configuration, remember. These lines will be expanded in the firewall's memory to the original 18 lines. The lines may not be sorted optimally, which can be an issue with com- plex configurations. As with most things, there are tradeoffs. For com- plex installations on Cisco PIX firewalls, make sure you enable Turbo ACLs (discussed in the following section). Notice that groups do not necessarily mean less typing-in fact, the opposite is usually true. Even though this access list has shrunk from 18 to 8 lines, we had to type in more lines than we saved. The goal is to make the access list easier to read and maintain. It's up to you to determine whether the eventual benefits will justify the initial effort. You can see the actual result of the configuration using the show access-list command. The output includes both the object-group configuration lines and the actual ACE