Cisco Systems CL-28826-01 Creating Networks/Hosts Objects

6-76

User Guide for Cisco Security Manager 4.4

OL-28826-01

Chapter 6 Managing Policy Objects

Understanding Networks/Hosts Objects

Although discontiguous network masks are not typically used for network configurations, they are

sometimes used for certain commands, such as filtering commands when defining access control lists

(ACLs). Security Manager supports the use of nonstandard network masks in the policies whose CLI

commands support them. An error is displayed if you try to define a discontiguous network mask in a

policy that does not support them.

Network Masks and Discovery

During discovery, Security Manager attempts to match network/host objects with existing equivalent

objects defined in the Policy Object Manager:

•For contiguous network masks—Two network/host objects containing only standard networks are

considered equivalent if they consist of the same set of IP addresses.

•For discontiguous network masks—Two network/host objects are considered equivalent only if the

standard networks consist of the same set of IP addresses and the nonstandard networks are

syntactically equivalent.

How Network Masks are Displayed

Although you can enter both contiguous and discontiguous network masks using dotted decimal

notation, all contiguous network masks are converted to CIDR notation. This makes it easier to

distinguish them from discontiguous network masks, which are displayed in dotted decimal notation

only.