Can I do this in an ASA?

John Blakley · ‎03-19-2009

All,

I'm converting from a Symantec Firewall (SF) to an ASA 5550. I've been looking through the ruleset on the SF, and I'm noticing that there are domain names listed as entities that reference another domain name.

This means that a firewall rule would, in ASA notation, look like:

permit ip host 5.5.5.5 host www.google.com.

name 10.10.10.10 www.google.com

I need the ASA to resolve to domain names to allow for traffic to domains that could possibly change ip addresses or have multiple ip addresses assigned to a domain name.

Is this possible?

Thanks,

John

HTH, John *** Please rate all useful posts ***

cisco24x7 · ‎03-19-2009

This is one of the many advantages that Symantec and CP firewalls have over Cisco.

The other features is the negation rule.

To my knowledge, it can not be done with ASA.

John Blakley · ‎03-19-2009

That's what I was afraid of. I think the only thing that I could do would be to create an object group and put the IPs that are registered to that domain in there.

HTH, John *** Please rate all useful posts ***

Collin Clark · ‎03-19-2009

Cisco wants you to use a (their) proxy server to control access. However you can use regex to block sites.

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080940e04.shtml

Hope that helps.