any host 192.168.1.201 eq smtp (hitcnt=0) 0xb52bad46 access-list In line 1 extended permit tcp any host 192.168.1.201 eq WWW (hitcnt=0) 0x881944d5 access-list In line 1 extended permit tcp any host 192.168.1.201 eq https (hitcnt=0) 0x4c466f6a access-list In line 1 extended permit tcp any host 192.168.1.228 eq smtp (hitcnt=0) 0x6c6c1ba9 access-list In line 1 extended permit tcp any host 192.168.1.228 eq WWW (hitcnt=0) 0xfca8e834 access-list In line 1 extended permit tcp any host 192.168.1.228 eq https (hitcnt=0) 0x7d7e2239 Notice that the line number for each entry is the same (line 1). This indicates that these entries are a result of the expansion of line 1, which in this example is the only line in the access list. When an object group is in use, it cannot be deleted. The ASA will bark at us with the following error if we attempt to delete the object group: ASA-5540/GAD(config-service)# no object-group service Webserver-svcs Removing object-group (Webserver-svcs) not allowed; object-group (Webserver-svcs), being used in access-list, would become empty We must either remove the references to it in the offending access lists or remove the access lists altogether. Once we do so, the ASA will allow us to delete the object group: ASA-5540/GAD(config)# clear configure access-list In ASA-5540/GAD(config)# no object-group service Webserver-svcs Inspects Fixups were the features on a PIX firewall that inspected application protocols. They have been replaced with application inspections, or inspects for short. While fixups were much easier to configure, inspects follow a more IOS-like method of implemen- tation in that they are embedded into a global service policy. It might look difficult, but it doesn't need to be. Inspects are used to enable complex protocols, such as FTP, that have multiple streams. They are also used to make protocols more secure. For example, the SMTP inspect limits the commands that can be run through the ASA within the SMTP protocol. To illustrate one of the common application inspections, I've c