Can I do this in an ASA?

Unanswered Question
Mar 19th, 2009


I'm converting from a Symantec Firewall (SF) to an ASA 5550. I've been looking through the ruleset on the SF, and I'm noticing that there are domain names listed as entities that reference another domain name.

This means that a firewall rule would, in ASA notation, look like:

permit ip host host


I need the ASA to resolve to domain names to allow for traffic to domains that could possibly change ip addresses or have multiple ip addresses assigned to a domain name.

Is this possible?



I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
cisco24x7 Thu, 03/19/2009 - 11:12

This is one of the many advantages that Symantec and CP firewalls have over Cisco.

The other features is the negation rule.

To my knowledge, it can not be done with ASA.

John Blakley Thu, 03/19/2009 - 11:36

That's what I was afraid of. I think the only thing that I could do would be to create an object group and put the IPs that are registered to that domain in there.


This Discussion