ollocated website. On a normal enterprise net- work, web servers should not reside on the inside network, but rather in a DMZ. Of course, "normal" is a very subjective word. Because the IP addresses of the three servers are not in a range that can be addressed with a single subnet mask, each server must have its own access list entry. Additionally, there must be an entry for each protocol for each server. As a result, you must configure nine access list entries to allow each of the three pro- tocols to these three servers: access-list In permit tcp any host 192.168.1.101 eq smtp access-list In permit tcp any host 192.168.1.101 eq WWW access-list In permit tcp any host 192.168.1.101 eq https access-list In permit tcp any host 192.168.1.201 eq smtp access-list In permit tcp any host 192.168.1.201 eq WWW access-list In permit tcp any host 192.168.1.201 eq https access-list In permit tcp any host 192.168.1.228 eq smtp access-list In permit tcp any host 192.168.1.228 eq WWW access-list In permit tcp any host 192.168.1.228 eq https While this may not seem like a big deal, imagine if the firewall had six interfaces and supported 140 servers. I've seen Cisco firewalls that had access lists 17 printed pages long. Figuring out all the permutations of protocols and servers can be maddening. The potential complexity of the access lists has led many businesses to ignore Cisco when Object Groups considering firewalls. With the object-group command, you can create a group of pro- tocols, networks, ICMP types, or services that you can reference by a name: ASA-5540/GAD(config)# object-group ? configure mode commands/options: icmp-type Specifies a group of ICMP types, such as echo network Specifies a group of host or subnet IP addresses protocol Specifies a group of protocols, such as TCP, etc service Specifies a group of TCP/UDP ports/services In the preceding example, each web server is using the same TCP ports. By assigning these common ports to a group, we can make the access list much smaller. Let's create an object group cal