topic Re: FQDN access in ASA 5545 in Network Security

FQDN access in ASA 5545

AnjaliRawat0713 — Fri, 01 Nov 2019 12:39:43 GMT

We want to allow few clients machines to be able to connect directly to various subdomains (For eg :- xzy.com )

We need the firewall to allow clients to be able to connect to *.xzy.com domains names (rather than by IP address).
Is it possible in ASA 5545 version 9.1(7)4

Re: FQDN access in ASA 5545

balaji.bandi — Fri, 01 Nov 2019 13:13:30 GMT

here is the good document to start with :

https://community.cisco.com/t5/security-documents/using-hostnames-dns-in-access-lists-configuration-steps-caveats/ta-p/3123480

Re: FQDN access in ASA 5545

AnjaliRawat0713 — Mon, 04 Nov 2019 07:21:43 GMT

Thank you for the response .

Re: FQDN access in ASA 5545

rdz586 — Tue, 05 Nov 2019 13:37:24 GMT

Hi Anjali,

I am pretty sure that ASA's cannot do wildcard FQDN's and you would have to add each FQDN into an object-group separately.

If the destination network has a list of static public IP addresses that it uses then you could permit the IP address range instead.

Re: FQDN access in ASA 5545

AnjaliRawat0713 — Tue, 05 Nov 2019 14:17:31 GMT

Thankyou rdz586 for replying.

Yes wildcard is not supported. I need to define the FQDN into object group separately. The traffic flow I am looking is something below . Can you suggest regarding the NAT configuration when the DNS would resolve to different public IPs.

Client machine (multiple subnet) --> accessing FQDN (URL ) --> DNS would resolve those url's to public IP .

Re: FQDN access in ASA 5545

AnjaliRawat0713 — Tue, 05 Nov 2019 14:18:24 GMT

The traffic flow I am looking is something below . Can you suggest regarding the NAT configuration when the DNS would resolve to different public IPs.

Client machine (multiple subnet) --> accessing FQDN (URL ) --> DNS would resolve those url's to public IP .

Re: FQDN access in ASA 5545

rdz586 — Tue, 05 Nov 2019 14:50:30 GMT

I assume you do not have a default NAT rule and you only NAT the traffic which is allowed by your access rules.

You can use the object-group with the FQDN to NAT the taffic:-

nat (INSIDE,OUTSIDE) source static Source_Group interface destination static FQDN_Group FQDN_Group service Port_Group Port_Group

The ports are optional if you only wanted certain traffic to be NAT'd out to the internet.

Hopefully I have understood your need and this helps out, please let me know if not.

Re: FQDN access in ASA 5545

balaji.bandi — Tue, 05 Nov 2019 20:14:58 GMT

yes you need to have DNS server to resolve basic start with for FQDN to work, yes *.bb.com not going to work. you need to have cisco.bb.com for resolution.

Re: FQDN access in ASA 5545

AnjaliRawat0713 — Wed, 06 Nov 2019 07:23:56 GMT

Thankyou rdz586 for the quick response.
We can onfigure FQDNs inside the objects but can't use them in a nat configuration, the ASA won't let you do it. It will even tell you that it's not supported .

Also regarding NAT part , dynamic PAT is being used for the inside interface.

object network inside_net_a.b.c.d
nat (inside,outside) dynamic interface

Can you now please suggest about the configuration part now.