led Webserver-SVCS. This will be a group of TCP services, which we'll define using port-object object group commands: object-group service Webserver-svcs tcp description For Webservers port-object eq smtp port-object eq WWW port-object eq https Now, instead of listing each service for each web server, we can simply reference the group for each web server. We do this by using the object-group keyword, followed by the group name: access-list In permit tcp any host 192.168.1.101 object-group Webserver-svcs access-list In permit tcp any host 192.168.1.201 object-group Webserver-svcs access-list In permit tcp any host 192.168.1.228 object-group Webserver-svcs This reduces the number of access list entries from nine to three, but we can do better. All of the IP addresses listed serve the same purpose-they are all web servers. Let's create another object group called Webservers. This time, the object group type will be network, and we'll use the network-object command to add objects to the group: object-group network Webservers description Webservers network-object host 192.168.1.101 network-object host 192.168.1.201 network-object host 192.168.1.228 We can now simplify the access list even more: access-list In permit tcp any object-group Webservers object-group Webserver-svcs What started as a nine-line access list has been compressed to one line. When we ex- ecute the show access-list command, the object groups will be expanded, and the resulting access list will be visible: ASA-5540/GAD(config)# show access-list Inbound access-list Inboun; 9 elements access-list In line 1 extended permit tcp any object-group Webservers object-group Webserver-svcs 0x6484a1ba access-list In line 1 extended permit tcp any host 192.168.1.101 eq smtp (hitcnt=0) 0x9ba9ede4 Chapter 28: ASA Firewall Configuration access-list In line 1 extended permit tcp any host 192.168.1.101 eq WWW (hitcnt=0) 0x34db9472 access-list In line 1 extended permit tcp any host 192.168.1.101 eq https (hitcnt=0) 0x821a0cfe access-list In line 1 extended permit tcp 