including features specific to the PIX, are covered in detail in Chapter 23. In the configuration, the IP address will be translated to the configured name: PIX# sho run I include 110 access-list 110 permit tcp any host FileServer eq WWW If you prefer to see the IP addresses, you can disable the names feature by negating the names command. The configuration will once again show the IP addresses: PIX(config)# no names PIX(config)# sho run I include 110 access-list 110 permit tcp any host 10.10.10.10 eq WWW Even with names enabled, the output of the show interface command will always show the IP addresses. If you need to see all the names configured on your PIX firewall, use the show names command: PIX# sho names name 10.10.10.1 PIX-Outside name 10.10.10.10 FileServer name 192.168.1.1 PIX-Inside The names feature is extremely helpful in that it makes PIX firewall configurations easier to read. With very large configurations, the number of IP addresses can be staggering, and trying to remember them all is a practical impossibility. Object Groups Object groups allow a group of networks, IP addresses, protocols, or services to be referenced with a single name. This is extremely helpful when configuring complex access lists. Take the situation shown in Figure 26-2. There are three web servers, each of which offers the same three protocols: SMTP (TCP port 25), HTTP (TCP port 80), and HTTPS (TCP port 443). Chapter 26: PIX Firewall Configuration Services on each Port 25: SMTP web server: Port 80: HTTP Web server #1 Port 443: HTTPS 192.168.1.101 Web server #2 192.168.1.201 Outside Inside Web server #3 192.168.1.228 Figure 26-2. Complex access-list scenario This example shows a collocated web site. On a normal enterprise net- work, web servers should not reside on the inside network, but rather in a DMZ. Because the IP addresses of the three servers are not in a range that can be addressed with a single subnet mask, each of the servers must have its own access-list entry. Additionally, there must be an entry for each protoc