Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 

Can I do this in an ASA?

All,

I'm converting from a Symantec Firewall (SF) to an ASA 5550. I've been looking through the ruleset on the SF, and I'm noticing that there are domain names listed as entities that reference another domain name.

This means that a firewall rule would, in ASA notation, look like:

permit ip host 5.5.5.5 host www.google.com.

name 10.10.10.10 www.google.com

I need the ASA to resolve to domain names to allow for traffic to domains that could possibly change ip addresses or have multiple ip addresses assigned to a domain name.

Is this possible?

Thanks,

John

HTH, John *** Please rate all useful posts ***
3 REPLIES
Silver

Re: Can I do this in an ASA?

This is one of the many advantages that Symantec and CP firewalls have over Cisco.

The other features is the negation rule.

To my knowledge, it can not be done with ASA.

Re: Can I do this in an ASA?

That's what I was afraid of. I think the only thing that I could do would be to create an object group and put the IPs that are registered to that domain in there.

HTH, John *** Please rate all useful posts ***

Re: Can I do this in an ASA?

Cisco wants you to use a (their) proxy server to control access. However you can use regex to block sites.

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080940e04.shtml

Hope that helps.

118
Views
0
Helpful
3
Replies
CreatePlease to create content