listing each service for each web server, we can simply reference the group for each web server. We do this by using the object-group keyword, followed by the group name: access-list In permit tcp any host 192.168.1.101 object-group Webserver-svcs access-list In permit tcp any host 192.168.1.201 object-group Webserver-svcs access-list In permit tcp any host 192.168.1.228 object-group Webserver-svcs This reduces the number of access-list entries from nine to three, but we can do bet- ter. All of the IP addresses listed serve the same purpose-they are all web servers. Let's create another object group called Webservers. This time, the object-group type will be network, and we'll use the network-object command to add objects to the group: object-group network Webservers description Webservers network-object host 192.168.1.101 network-object host 192.168.1.201 network-object host 192.168.1.228 We can now simplify the access list even more: access-list In permit tcp any object-group Webservers object-group Webserver-svcs What started as a nine-line access list has been compressed to one line. When we execute the show access-list command, the object groups will be expanded, and the resulting access list will be visible: PIX# sho access-list TurboACL statistics: State Memory(KB) Operational 2 Shared memory usage: 2056 KB access-list compiled access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 1024) alert-interval 300 Chapter 26: PIX Firewall Configuration access-list In line 1 permit tcp any object-group Webservers object-group Webserver-svcs access-list In line 1 permit tcp any host 192.168.1.101 eq smtp (hitcnt=0) access-list In line 1 permit tcp any host 192.168.1.101 eq WWW (hitcnt=0) access-list In line 1 permit tcp any host 192.168.1.101 eq https (hitcnt=0) access-list In line 1 permit tcp any host 192.168.1.201 eq smtp (hitcnt=0) access-list In line 1 permit tcp any host 192.168.1.201 eq WWW (hitcnt=0) access-list In line 1 permit tcp any host 192.168.1.201 eq https (hitcnt=0) access-list In line 1