operational speed of a heavily used firewall. Using Groups in PIX ACLs PIX firewalls now allow the use of groups in access lists. This is a huge benefit for access-list creation because it allows for very complex ACLs with very simple config- urations. Using groups in ACLs also allows you to change multiple ACLs by changing a group-when a group that is in use is changed, the PIX will automati- cally change every instance where the group is applied. With complex access lists, using groups can help prevent mistakes because it's less likely that you'll forget an important entry: you don't have to make the addition in multiple places, you only have to remember to put it into the group. Chapter 23: Access Lists Let's look at an example of groups in action. Here is the original ACL: object-group service CCIE-Rack tcp description [< For Terminal Server Reverse Telnet ] port-object range 2033 2050 access-list Inbound permit tcp any host gto eq WWW access-list Inbound permit tcp any host gto eq ssh access-list Inbound permit tcp any host meg eq ssh access-list Inbound permit tcp any host meg eq WWW access-list Inbound permit tcp any host lab eq telnet access-list Inbound permit tcp any host lab object-group CCIE-Rack access-list Inbound permit udp any host PIX-Outside eq 5060 access-list Inbound permit tcp any host lab eq 8080 access-list Inbound permit udp any host meg eq domain access-list Inbound permit udp any host gto eq domain access-list Inbound permit tcp any host gto eq smtp access-list Inbound permit tcp any host meg eq smtp access-list Inbound permit tcp any host gto eq imap4 access-list Inbound permit tcp any host meg eq imap4 access-list Inbound permit esp any any access-list Inbound permit icmp any any unreachable access-list Inbound permit icmp any any time-exceeded access-list Inbound permit icmp any any echo-reply Notice that there is an object group already in use for CCIE-Rack. This may not seem necessary, as the same thing could be accomplished with the range keyword: access-list Inbound line 3 permit 