03-19-2009 10:12 AM - edited 03-11-2019 08:07 AM
All,
I'm converting from a Symantec Firewall (SF) to an ASA 5550. I've been looking through the ruleset on the SF, and I'm noticing that there are domain names listed as entities that reference another domain name.
This means that a firewall rule would, in ASA notation, look like:
permit ip host 5.5.5.5 host www.google.com.
name 10.10.10.10 www.google.com
I need the ASA to resolve to domain names to allow for traffic to domains that could possibly change ip addresses or have multiple ip addresses assigned to a domain name.
Is this possible?
Thanks,
John
03-19-2009 11:12 AM
This is one of the many advantages that Symantec and CP firewalls have over Cisco.
The other features is the negation rule.
To my knowledge, it can not be done with ASA.
03-19-2009 11:36 AM
That's what I was afraid of. I think the only thing that I could do would be to create an object group and put the IPs that are registered to that domain in there.
03-19-2009 01:41 PM
Cisco wants you to use a (their) proxy server to control access. However you can use regex to block sites.
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080940e04.shtml
Hope that helps.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: