Not tried it on a vss, but have used it on plain 6500. Works a treat, don't forget the "expand" option to a show ip access-list to see whats going on
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/con figuration/guide/acl.html Router(config)# object-group ip address myAG Router(config-ipaddr-pgroup)# host 10.20.20.1 Router(config-ipaddr-pgroup)# host 10.20.20.5 Router(config-ipaddr-pgroup)# 10.30.0.0 255.255.0.0 Router(config)# object-group ip port myPG Router(config-port-pgroup)# eq 100 Router(config-port-pgroup)# gt 200 Router(config-port-pgroup)# neq 300 Router(config)# ip access-list extended my-pbacl-policy Router(config-ext-nacl)# permit tcp addrgroup myAG portgroup myPG any Router(config-ext-nacl)# deny tcp any any Router(config-ext-nacl)# exit Router(config)# exit Router# show ip access-list my-pbacl-policy Extended IP access list my-pbacl-policy 10 permit tcp addrgroup AG portgroup PG any 20 permit tcp any any Router# show ip access-list my-pbacl-policy expand Extended IP access list my-pbacl-policy expanded 20 permit tcp host 10.20.20.1 eq 100 any 20 permit tcp host 10.20.20.1 gt 200 any 20 permit tcp host 10.20.20.1 neq 300 any 20 permit tcp host 10.20.20.5 eq 100 any 20 permit tcp host 10.20.20.5 gt 200 any 20 permit tcp host 10.20.20.5 neq 300 any 20 permit tcp 10.30.0.0 255.255.0.0 eq 100 any 20 permit tcp 10.30.0.0 255.255.0.0 gt 200 any 20 permit tcp 10.30.0.0 255.255.0.0 neq 300 any > -----Original Message----- > From: [email protected] [mailto:cisco-nsp- > [email protected]] On Behalf Of Arne Larsen / Region Nordjylland > Sent: 01 June 2010 09:43 > To: '[email protected]' > Subject: [c-nsp] vs addrgroup and access-lists on vss software > > Hi All. > > I'm trying to use addrgroup in access-list on a vss setup, but I can't > seem to get it working. > If I setup an statement in a access-list it just ignores it. > Has someone any doc. about this. > > /Arne > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________________ Atos Origin and Atos Consulting are trading names used by the Atos Origin group. The following trading entities are registered in England and Wales: Atos Origin IT Services UK Limited (registered number 01245534) and Atos Consulting Limited (registered number 04312380). The registered office for each is at 4 Triton Square, Regents Place, London, NW1 3HG.The VAT No. for each is: GB232327983 This e-mail and the documents attached are confidential and intended solely for the addressee, and may contain confidential or privileged information. If you receive this e-mail in error, you are not authorised to copy, disclose, use or retain it. Please notify the sender immediately and delete this email from your systems. As emails may be intercepted, amended or lost, they are not secure. Atos Origin therefore can accept no liability for any errors or their content. Although Atos Origin endeavours to maintain a virus-free network, we do not warrant that this transmission is virus-free and can accept no liability for any damages resulting from any virus transmitted. The risks are deemed to be accepted by everyone who communicates with Atos Origin by email. _______________________________________________________ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
