u look at the preceding output, you'll see that DNS shows far more connections than SMTP. Check to see what's actually running on your network, and configure accordingly. The problem with this approach can be a loss of readability. In this case, the original ACL is much easier to read and understand than the redesigned version. The second, more efficient ACL has an entry for web2 in the middle of all the entries for web1. This is easy to miss, and can make troubleshooting harder. Only you, as the administrator, can make the call as to the benefits or drawbacks of the current ACL design. In smaller ACLs, you may want to make some concessions for readability, but in the case of a 17- page access list, you'll find that putting the most-used lines at the top will have a sig- nificant impact on the operational speed of a heavily used firewall. Using Groups in ASA and PIX ACLs ASA and PIX firewalls now allow the use of groups in access lists. This is a huge benefit for access list creation because it allows for very complex ACLs with very simple con- figurations. Using groups in ACLs also allows you to change multiple ACLs by changing a group-when you change a group that is in use, the PIX will automatically change every instance where that group is applied. With complex access lists, using groups can help prevent mistakes, because you're less likely to forget an important entry: you don't have to make the addition in multiple places, you only have to remember to put it into the group. Let's look at an example of groups in action. Here is the original ACL: object-group service CCIE-Rack tcp description [< For Terminal Server Reverse Telnet > ] port-object range 2033 2050 access-list Inbound permit tcp any host gto eq WWW access-list Inbound permit tcp any host gto eq ssh access-list Inbound permit tcp any host meg eq ssh access-list Inbound permit tcp any host meg eq WWW access-list Inbound permit tcp any host lab eq telnet access-list Inbound permit tcp any host lab object-group CCIE-Rack access-list Inbound permit ud