Hi,

So if I understood you correctly then you have

• FW1 with an "object-group" configured that contains inside it another "object-group"
• FW2 with an "object-group" with 3 "network-object" statements which you want to remove and replace with a similiar "object-group" as in FW1

If this is true then I guess this is a similiar thing that you asked before.

You would have to have this already on FW2 or configure this on the FW2

object-group network test

network-object object 10.0.0.0

network-object object 172.16.0.0

network-object object 192.168.0.0

You would then add this "object-group" under the other "object-group"

object-group network subnet1

group-object test

And while under the "object-group network subnet1" configuration space you would remove the "network-object" configuration lines

no network-object 10.0.0.0 255.0.0.0

no network-object 192.168.0.0 255.255.0.0

no network-object 172.16.0.0 255.240.0.0

With that order you should have the same subnets/networks under the "object-group" all the time. You SHOULD NOT remove the "subnet1" object though if its in use in an ACL I think the ASA wont even let you remove it.

Again if these are used only for interface ACLs then I imagine these changes wouldnt cause a problem. If they would be used for NAT then I am not so sure.

I personally am not a big fan of grouping objects under other objects. In the long run the configurations become hard to read.

- Jouni