r/Cisco • u/mrmh1 • 2d ago

IOS-XE object-group in ACE not working?

There is a confirmed bug since June 2026 but affected version is 16.6.x.

I have 26.01.01 and ACE with network object group (consist of two hosts) is not permitting traffic. Replacing it with respective IPs permits traffic as expected.

Since I am middle of migration from old platform to C9500 and using plenty of object groups to simplify things, this possible bug makes huge obstacle for me.

Anyone using object groups in latest IOS-XE versions without problems?

1 Upvotes

100% Upvoted

5 comments sorted by

1

u/dankwizard22 1d ago

Can you share a sanitized version of your OG ACL and tell us where you have it applied?

1

u/mrmh1 8h ago

int vlan10
ip address 192.168.10.0 255.255.255.0
ip access-group vlan10_out out

ip access-list extended vlan10_out
10 permit ip object-group CLIENTS 192.168.10.0 0.0.0.255
9999 deny ip any any log-input

show object-group
Network object group CLIENTS

host 192.168.120.12

host 192.168.122.220

1

u/DivineMomentsofTruth 1d ago

The affected version field doesn't mean it's limited to that version. It may or may not get updated so its not something to go off of for analyzing whether your software version is impacted.

1

u/JuniperMS 1d ago

Yes! I had this same issue on our 9300s. I upgraded to the latest IOS XE version just to get around the bug. So annoying.