topic Re: ACLs and FQDN Not Working - Cisco ASA in Network Security

ACLs and FQDN Not Working - Cisco ASA

Jhon Fredy Herrera Osorno — Wed, 18 May 2022 19:39:46 GMT

Hi team,

I can´t make that access-lists works with FQDN.

when i do show access-list the output show (unresolved) any (inactive)

ASA CODE is Cisco Adaptive Security Appliance Software Version 9.12(4)38

here is the configacl,asa,fqdnasa

dns domain-lookup LAN
DNS server-group DefaultDNS
name-server 208.67.222.123 OUTSIDE
name-server 208.67.220.123 OUTSIDE
name-server 1.1.1.1 OUTSIDE
name-server 1.0.0.1 OUTSIDE
name-server 192.168.0.19 LAN
domain-name lab.local

object network GOOGLE
fqdn v4 www.google.com

access-list PRUEBA extended permit ip object GOOGLE any

when i do:

ping www.google.com

ciscoasa# ping www.google.com
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 142.250.78.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 10/18/20 ms
ciscoasa#

as you can see work the resolution.

Thanks for the help.

Re: ACLs and FQDN Not Working - Cisco ASA

Sheraz.Salim — Wed, 18 May 2022 20:32:23 GMT

does your rule should be not this

access-list PRUEBA extended permit ip any object GOOGLE

looking into your log entry issue seem to be with Unreachable DNS server. if DNS server is not reachable and the ASA is unable to resolve the IP of the FQDN then the ACL will be marked as ‘inactive’,

Re: ACLs and FQDN Not Working - Cisco ASA

Jhon Fredy Herrera Osorno — Wed, 18 May 2022 21:19:25 GMT

Thanks,

After after reading in depth, fqdn is not resolved until the access list is applied to an interface.

and i solve my needs with dynamic split tunnel according to this document

Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 4.6 - Configure VPN Access [Cisco AnyConnect Secure Mobility Client] - Cisco

Thanks