Route Based VPNs on ASA 5545 VTI tunnel

[fcardoso]

Hi, 

-I tried to configure the interface tunnel on ASA5545 side:

"interface Tunnel1
nameif xxx
ip address 192.168.0.1 255.255.255.252
tunnel source interface outside
tunnel destination example.dnip.xx.com 
ERROR: % Invalid Hostname"

is giving the error "invalid Hostname" ....

-But if i do a ping from the ASA5545 to  "example.dnip.xx.com" it resolves the name and the ping´s work

-my dns configuration is:

DNS server-group DefaultDNS
name-server 8.8.8.8

dns domain-lookup outside

-How can i resolve this issue?

Best Regards

Fernando

[M02@rt37]

Hello @fcardoso,

Check here:

https://community.cisco.com/t5/network-security/site-to-site-tunnel-with-fqdn/td-p/1266527

[fcardoso]

Hello M02@rt37 

I check your post and other post https://community.cisco.com/t5/security-knowledge-base/using-hostnames-dns-in-access-lists-configuration-steps-caveats/ta-p/3123480/page/2 and i did the following conf:

Create the FQDN object for the host name in question:

object network obj.example.dnip.com
fqdn example.dnip.xx.com

Add the FQDN Oject to an ACL:

access-list outside_access_in extended deny ip any object obj.example.dnip.com
access-list outside_access_in extended permit ip any any

-If i verify the acl and the dns seems to be OK:

show access-list outside_access_in

access-list outside_access_in line 3 extended deny ip any object obj.example.dnip.com (hitcnt=0)
access-list outside_access_in line 3 extended deny ip any fqdn example.dnip.xx.com (resolved)
access-list outside_access_in line 3 extended deny ip any host xxx.xxx.xxx.xxx (example.dnip.xx.com)

and 

sh dns
Name: example.dnip.xx.com
Address: xxx.xxx.xxx.xxx TTL 00:01:57

- But unfortunately the problem continues, I can't configure the tunnel destination using the hostname....any idea?

thanks

Fernando