Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

ASA 8.4.4 filter url using hostname

Hello ... is there any way to apply hostname or object network in the syntax?

The command gives the option to use hostname or A.B.C.D but doesn't accept the hostname

PIX1(config)# filter url except 0.0.0.0 0.0.0.0 ?

configure mode commands/options:
  Hostname or A.B.C.D  The address of foreign/external host which is
                       destination for connections requiring filtering

Can an FQDN be used as a foreign/external host?

Thanks.

Everyone's tags (4)
3 REPLIES
Super Bronze

Re: ASA 8.4.4 filter url using hostname

Hi,

I'm not sure if I have every used the command you are using in your example. Is it related to using an external server for the filtering?

There is though an option to use FQDN on the access-list if you are running atleast 8.4(2) on the ASA

For example a Facebook block could be configured like this

dns domain-lookup outside

DNS server-group DefaultDNS

    name-server x.x.x.x

    name-server y.y.y.y

object network FACEBOOK-FQDN

fqdn www.facebook.com

access-list INSIDE-IN remark Block Facebook

access-list INSIDE-IN extended deny ip any object FACEBOOK-FQDN

Then again the above configuration would not completely block Facebook for example since the destination address keeps changing. (Would have to resort to dropping the HTTP connections, dropping the DNS replys, dropping the traffic on the basis of the destination IP address etc.

- Jouni

VIP Purple

ASA 8.4.4 filter url using hostname

This feature is very good explained in a supportforum-doc:

https://supportforums.cisco.com/docs/DOC-17014

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni


--
Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
New Member

ASA 8.4.4 filter url using hostname

Thank y ou Jouni and Karsten. I'm aware of the use in access-lists but was hoping there was some way to apply the fqdn feature to the filter url command.

526
Views
0
Helpful
3
Replies