Silly question: DNS name instead of IP address in ASA ACL

DSmirnov · ‎04-02-2008

Hello,

one silly question - is it possible to specify DNS name in ACL on ASA? e.g.

access-list ACL-TEST extended permit tcp any host www.example.com eq ssh

If it is not possible - any plans to add that feature? Can be really useful for outbound restrictions.

cisco24x7 · ‎04-02-2008

No it is not possible with Pix or ASA.

if you want that feature, go with Checkpoint

or Juniper.

cpembleton · ‎04-03-2008

You can match and drop traffic using application inspection. Setup a HTTP inpsection policy and use regex to match the URL and set it to drop. See Link.

http://www.cisco.com/en/US/customer/docs/security/asa/asa72/configuration/guide/inspect.html#wp1514315

Easier way would be to setup websense or N2H proxies that the ASA could check against.

Hope this helps.

Chad