s-list Inbound permit tcp any host lab object-group CCIE-Rack access-list Inbound permit udp any host PIX-Outside eq 5060 access-list Inbound permit tcp any host lab eq 8080 access-list Inbound permit esp any any access-list Inbound permit icmp any any object-group ICMP-Types The access list has gone from 18 lines down to 8. This is only the visible configura- tion, remember. These lines will be expanded in the firewall's memory to the original 18 lines. The lines may not be sorted optimally, which can be an issue with complex configurations. As with most things, there are tradeoffs. For complex installations, make sure you enable Turbo ACLs (discussed in the following section). Note that groups do not necessarily mean less typing-in fact, the opposite is usually true. Even though this access list has shrunk from 18 to 8 lines, we had to type in more lines than we saved. The goal is to make the access list easier to read and maintain. It's up to you to determine whether the eventual benefits will justify the initial effort. The actual result of the configuration can be seen using the show access-list com- mand. The output includes both the object-group configuration lines, and the actual ACEs to which they translate. The object-group entries are shown in bold: GAD-PIX# sho access-list access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 1024) alert-interval 300 access-list Inbound; 20 elements access-list Inbound line 1 permit udp any object-group Webservers object-group Webserver-svcs-udp Chapter 23: Access Lists access-list Inbound line 1 permit udp any host gto eq domain (hitcnt=7265) access-list Inbound line 1 permit udp any host meg eq domain (hitcnt=6943) access-list Inbound line 2 permit tcp any object-group Webservers object-group Webserver-svcs access-list Inbound line 2 permit tcp any host gto eq WWW (hitcnt=21335) access-list Inbound line 2 permit tcp any host gto eq ssh (hitcnt=4428) access-list Inbound line 2 permit tcp any host gto eq domain (hitcnt=0) access-list Inbound line 2 permit