topic Access-list - Hostname as source in Network Security

Access-list - Hostname as source

Tauer Drumond — Mon, 11 Mar 2019 21:06:31 GMT

Hi all,

I have an ASA 5540 and I'd like to create a rule using a specific host name as source of the traffic, not an ip address.

Is that possible?

My firewall already resolves names to IP address so I can ping all my internal hosts by name

Thanks

Tauer

Access-list - Hostname as source

John Blakley — Mon, 01 Aug 2011 15:56:23 GMT

It's not possible unfortunately. If this is an address that resolves to an internet hostname, you'll need to run nslookup on that hostname to get the addresses. You can then create an object-group for ease of management. (It *might* work on the new IOS version, but I'm running 8.0x and it doesn't work.)

Example:

Hostname: bing.com

nslookup bing.com

1.1.1.1

2.2.2.2

object-group network bing.com

network host 1.1.1.1

network host 2.2.2.2

access-list INSIDE permit ip any object-group bing.com

That's the only way that I know you'd be able to do it.

The firewall will translate addresses from the CLI, but it won't do it for your hosts.

HTH,

John

Access-list - Hostname as source

Tauer Drumond — Mon, 01 Aug 2011 16:12:27 GMT

Hi John,

thank you so much!