Object Group

Object groups let you name a set of IPv4 addresses, IPv6 addresses, or Layer 4 ports once and reference that name from many ACL entries instead of repeating each match. Address object groups (object-group ip address and object-group ipv6 address) contain sequenced host or network entries, specified as a prefix with a prefix length or a wildcard mask. Port object groups (object-group ip port) contain sequenced port match entries using the eq, neq, lt, gt, or range operators. Groups are referenced from the addrgroup and portgroup attributes of the source and destination of IP and IPv6 access list entries.

Diagram

Classes

nxos

Name	Type	Constraint	Mandatory	Default Value
devices	List	devices	No
device_groups	List	device_groups	No
global	Class	global	No
templates	List	templates	No

devices (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

device_groups (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

global (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

templates (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

configuration (nxos.devices)

Name	Type	Constraint	Mandatory	Default Value
object_group	Class	object_group	No

object_group (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
ip_addresses	List	ip_addresses	No
ipv6_addresses	List	ipv6_addresses	No
ip_ports	List	ip_ports	No

ip_addresses (nxos.devices.configuration.object_group)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
entries	List	entries	No

ipv6_addresses (nxos.devices.configuration.object_group)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
entries	List	entries	No

ip_ports (nxos.devices.configuration.object_group)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
entries	List	entries	No

entries (nxos.devices.configuration.object_group.ip_addresses)

Name	Type	Constraint	Mandatory	Default Value
sequence_number	Integer	min: 1, max: 4294967295	Yes
prefix	IP		No
prefix_length	Integer	min: 0, max: 32	No
prefix_mask	IP		No

entries (nxos.devices.configuration.object_group.ipv6_addresses)

Name	Type	Constraint	Mandatory	Default Value
sequence_number	Integer	min: 1, max: 4294967295	Yes
prefix	IP		No
prefix_length	Integer	min: 0, max: 128	No
prefix_mask	String		No

entries (nxos.devices.configuration.object_group.ip_ports)

Name	Type	Constraint	Mandatory	Default Value
sequence_number	Integer	min: 1, max: 4294967295	Yes
port_operator	Choice	none, eq, neq, lt, gt, range	No
port_1	Any	String or Integer or String[Regex: ^.*[\$\%]\{.*$]	No
port_2	Any	String or Integer or String[Regex: ^.*[\$\%]\{.*$]	No

Examples

Example 1: IPv4 address and port object groups referenced from an ACL

nxos:
  devices:
    - name: LEAF1
      configuration:
        object_group:
          ip_addresses:
            - name: WEB-SERVERS
              entries:
                - sequence_number: 10
                  prefix: 10.10.10.0
                  prefix_length: 24
                - sequence_number: 20
                  prefix: 10.10.20.5
                  prefix_length: 32
            - name: CLIENT-NETWORKS
              entries:
                - sequence_number: 10
                  prefix: 10.100.0.0
                  prefix_mask: 0.0.255.255
          ip_ports:
            - name: WEB-PORTS
              entries:
                - sequence_number: 10
                  port_operator: eq
                  port_1: 80
                - sequence_number: 20
                  port_operator: eq
                  port_1: 443
                - sequence_number: 30
                  port_operator: range
                  port_1: 8080
                  port_2: 8090
        ip_access_lists:
          - name: ACL-WEB-ACCESS
            entries:
              - sequence_number: 10
                action: permit
                protocol: tcp
                source:
                  addrgroup: CLIENT-NETWORKS
                destination:
                  addrgroup: WEB-SERVERS
                  portgroup: WEB-PORTS

Example 2: IPv6 address object group referenced from an IPv6 ACL

nxos:
  devices:
    - name: LEAF1
      configuration:
        object_group:
          ipv6_addresses:
            - name: DC-V6-PREFIXES
              entries:
                - sequence_number: 10
                  prefix: "2001:db8:10::"
                  prefix_length: 64
                - sequence_number: 20
                  prefix: "2001:db8:20::"
                  prefix_length: 64
        ipv6_access_lists:
          - name: ACL6-DC-ONLY
            entries:
              - sequence_number: 10
                action: permit
                protocol: ipv6
                source:
                  addrgroup: DC-V6-PREFIXES
                destination:
                  prefix: any
              - sequence_number: 1000
                action: deny
                protocol: ipv6
                source:
                  prefix: any
                destination:
                  prefix: any
                log: true