ASA Version 7.2(4)
!
hostname asa-test
domain-name test.test.com
enable password admin
names
dns-guard
!
interface Vlan1
shutdown
nameif dmz
security-level 50
no ip address
!
interface Vlan5
nameif inside
security-level 0
ip address 192.168.5.1 255.255.252.0
!
interface Vlan6
nameif outside
security-level 10
ip address 192.168.10.2 255.255.252.0
!
interface Ethernet0/0
description Inside
switchport access vlan 5
switchport trunk allowed vlan 6
switchport trunk native vlan 6
switchport mode trunk
!
interface Ethernet0/1
switchport access vlan 2
!
interface Ethernet0/2
shutdown
!
interface Ethernet0/3
shutdown
!
interface Ethernet0/4
shutdown
!
interface Ethernet0/5
switchport access vlan 3
!
interface Ethernet0/6
switchport access vlan 5
!
interface Ethernet0/7
description Inside
switchport trunk allowed vlan 1,5
switchport trunk native vlan 5
switchport mode trunk
!
banner exec ########################################
banner exec This is a ASA for TESTS #
banner exec ########################################
boot system disk0:/asa724-k8.bin
ftp mode passive
clock timezone MSK/MSD 4
clock summer-time MSK/MDD recurring last Sun Mar 2:00 last Sun Oct 3:00
dns server-group DefaultDNS
domain-name test.test.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group network EXTERNAL
network-object host 8.8.8.8
network-object host 127.92.65.25

object-group network Clients
network-object 192.168.5.0 255.255.255.0

access-list inside_access_in extended permit tcp object-group Clients object-group EXTERNAL
access-list inside_access_out extended permit tcp object-group Clients object-group EXTERNAL
access-list outside_access_out extended permit tcp object-group Clients object-group EXTERNAL
access-list proxyp extended permit ip any any
access-list ADMIN extended permit ip 192.168.5.0 255.255.255.0 any
access-list outside_access_in extended permit tcp object-group Clients object-group EXTERNAL
pager lines 24
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-522.bin
no asdm history enable
arp timeout 14400
nat (inside) 0 0.0.0.0 0.0.0.0
access-group inside_access_in in interface inside
access-group inside_access_out out interface inside
access-group outside_access_in in interface outside
access-group outside_access_out out interface outside
http server enable
http 192.168.5.0 255.255.255.0 inside
dhcpd address 192.168.5.10-192.168.5.250 inside

У меня вопрос. как правильно настроить акцесс листы, чтобы из подсети 192.168.5.1/ 255,255,252,0  (Clients)  разрешено было  ходить только на два адреса из группы object-group network EXTERNAL
network-object host 8.8.8.8
network-object host 127.92.65.25

И наоборот.
Я уже третий день копаюсь.
Помогите пожалуйста!
Спасибо!