Object Group FQDN

FQDN-based object groups define collections of fully qualified domain names and regex patterns that can be referenced by access control lists and zone-based firewall policies. They enable domain-based traffic filtering without requiring explicit IP addresses, allowing policies to adapt as DNS resolutions change.

Diagram

Classes

configuration (iosxe.devices)

Name	Type	Constraint	Mandatory	Default Value
object_groups_fqdn	List	[object_groups_fqdn]	No

object_groups_fqdn (iosxe.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
description	String		No
group_objects	List	String	No
patterns	List	String	No

Object Group FQDN Parameters:

• Name - Unique identifier for the FQDN object group (1-64 characters)
• Description - Optional description text (1-200 characters)
• Group Objects - References to other FQDN object groups for nesting
• Patterns - FQDN regex patterns (1-240 characters each)

Guidelines and Limitations

• Patterns use regex syntax, not plain FQDNs. Literal dots must be escaped with \ (e.g., example\.com not example.com).
• Use .* for wildcard matching (e.g., .*\.malware\.net matches any subdomain of malware.net).
• The dot character . is only allowed unescaped at the beginning of a pattern. Everywhere else it must be \..
• Group objects reference other FQDN object groups by name, enabling hierarchical grouping. The referenced group must already be defined.

Sample Configuration:

object-group fqdn FQDN_GROUP_1
 description Block malicious domains
 pattern .*\.malware\.net
 pattern evil\.example\.com
!
object-group fqdn FQDN_GROUP_2
 description Combined group
 group-object FQDN_GROUP_1
 pattern .*\.phishing\.org
!

Example Code:

iosxe:
  devices:
    - name: ROUTER-1
      configuration:
        object_groups_fqdn:
          - name: FQDN_GROUP_1
            description: Block malicious domains
            patterns:
              - ".*\\.malware\\.net"
              - "evil\\.example\\.com"
          - name: FQDN_GROUP_2
            description: Combined group
            group_objects:
              - FQDN_GROUP_1
            patterns:
              - ".*\\.phishing\\.org"