This solution is a very simple one:

Original:

object-group service test tcp

port-object eq 8080

port-object eq 8081

port-object eq 8082

port-object eq 22

port-object eq 21

port-object eq 23

port-object eq 8000

access-list External extended permit icmp any any log

access-list External extended permit tcp any any object-group test log

Now you want to re-arrange so that it will look something WITHOUT disrupting the traffics:

object-group service test tcp

port-object eq 21

port-object eq 22

port-object eq 23

port-object eq 8000

port-object eq 8080

port-object eq 8081

port-object eq 8082

what you will do is this:

1- create a temp group-object:

object-group service temp tcp

port-object eq 21

port-object eq 22

port-object eq 23

port-object eq 8000

port-object eq 8080

port-object eq 8081

port-object eq 8082

2- put this group-object inside test group:

object-group service test tcp

group-object temp

3- Now remove the following lines inside test:

no port-object eq 8080

no port-object eq 8081

no port-object eq 8082

no port-object eq 22

no port-object eq 21

no port-object eq 23

no port-object eq 8000

port-object eq 21

port-object eq 22

port-object eq 23

port-object eq 8000

port-object eq 8080

port-object eq 8081

port-object eq 8082

no group-object temp

You will NOT disrupt any live traffics and

achieving your requirements.

This is the reason why I hate Pix. A very

complicate and stupid way of doing something very simple as this.

CCIE Security