I'm encountering some unexpected behavior when trying to reference object-groups in an access-list on my Catalyst 4500.

Goal: Restrict a VLAN from accessing other privately addressed subnets (Internet access only), except for a local DNS server in another subnet

IOS-XE Version: 03.03.00.XO RELEASE SOFTWARE (fc2)

General Config:

object-group network subnet_privateClassA
object-group network subnet_privateClassB
object-group network subnet_privateClassC
object-group network subnet_rfc1918All 
 group-object subnet_privateClassA
 group-object subnet_privateClassB
 group-object subnet_privateClassC


interface Vlan70
 ip address
 ip access-group publicVlan_in in

The following access-list blocks access to private IP ranges, except for the desired DNS server (, but also blocks access to public IPs. So, DNS is able resolve google.com, but pings fail.

ip access-list extended publicVlan_in
 permit ip any host
 deny ip any object-group subnet_rfc1918All ! (I've also tried just subnet_privateClassA)
 permit ip any any

The next access list works exactly how I want - local DNS works and I can access the Internet:

ip access-list extended publicVlan_in
 permit ip any host
 deny   ip any
 deny   ip any
 deny   ip any
 permit ip any any

The problem seems to be the use of object-groups. What am I missing here?

  • I suspect a typo. Can you post the actual config?
    – Ron Trunk
    Mar 16, 2015 at 22:07
  • show ip access-group publicVlan_in for both versions of the ACL
    – Ricky
    Mar 16, 2015 at 23:09
  • @Ron, I've updated my post with a copy/paste from my config. Mar 17, 2015 at 14:57
  • @RickyBeam - That access list is in production temporarily, so I can't update it to the non-working configuration just now. I did however examine the output of show ip access-list publicVlan_in (I'm assuming that's what you mean) while troubleshooting originally. I used pings to generate traffic, but the entry referencing the object-group didn't seem to be incrementing proportionally. I'm not sure what that means... Mar 17, 2015 at 15:11
  • If it doesn't appear to be automatically incrementing properly when using the object-group access list, have you tried manually incrementing each rule (10, 20, 30, etc) and then applying the newly created list? Mar 17, 2015 at 18:27

2 Answers 2


At long last, an answer. I recently encountered another situation where I had to create access-lists that would benefit from object-group references. After trying several different things to work around the problem, I finally threw in the towel and contacted Cisco technical support (which I'm always loath to do).

After an initial careless and blatantly wrong attempt to answer my question, the Cisco technician came back with the following:


I have reached out to the development team and object group configuration with the 4500 platform does not work as desired given the fact that the feature is not fully supported until code version 15.2(3)E2 which will be released around August 2015.

It is possible for the ACL to be configured because they have the same IOS XE base as other devices that support the feature at this time.

So, there you go - and it only took Cisco 6 days to come up with this answer (a record).


Use a policy routing instead. Two line to ACL deny any to inside DNS server then allow all else inside. Set the next hop to the ISP interface's IP address.


Router(config-route-map)# set ip next-hop ip-address [ip-address]

Specifies the next hop to which the packet will be routed, and the next hop must be an adjacent interface of the next router.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.