topic Extended access-list error using FQDN in Network Security

Extended access-list error using FQDN

michellp — Mon, 11 Mar 2019 21:46:52 GMT

Hi,

I'm trying to add an access-list rule to allow internal servers to connect an outside host on a asa 5540. The hostname translates to multiple ip's. Normally I just lookup the ip address or one of the ip's the hostname translates too and use that in the access-list as the host.

For some reason the actual ip's, which are a few, are not always available so using a specific ip sometimes does not work, thus the reason I have to use the hostname instead of the ip. I have 2 hostnames. www.hostname.com and subdomain.hostname.com.

This is how I normally add these rules (the ip addresses are fictive):

access-list internet_access extended permit tcp host 192.168.50.5 host 84.115.57.121 eq www log

When I try to add this using the hostname on our asa I get an error:

access-list internet_access extended permit tcp host 192.168.50.5 host www.hostname.com ?
ERROR: % Unrecognized command

I've tried it without the 'www', so hostname.com but same error.

How can I solve this?

Thanks in advance for your time and help

Regards,

Extended access-list error using FQDN

michellp — Mon, 07 Nov 2011 08:18:11 GMT

By the way, creating an object-group or network-object, gives the same result, error.

Re: Extended access-list error using FQDN

zulqurnain — Mon, 07 Nov 2011 10:48:23 GMT

Hi,

As far I can remember and experienced Cisco ASA does not allow you to configure access-list using hostname , access-list can only have ip-address and ports.

HTH

Sent from Cisco Technical Support iPad App

Extended access-list error using FQDN

michellp — Mon, 07 Nov 2011 12:31:27 GMT

@zulqurnain

Thanks for your reply. Indeed the asa does not allow me to use a hostname. The question is, how can I still make this work without going for 'any' or adding all the possible ip's it might translate too.

Extended access-list error using FQDN

chris baranowski — Mon, 07 Nov 2011 20:45:37 GMT

zulqurnain is correct, you cannot add a hostname to an ACL it has to be an IP address. The only way to filter traffic is by adding the IP address and ports of hostename.com to the ACL.