ACL to filter FTP server by hostname only

[anthodigbo]

Hi guys

I was wondering if it is possible to allow traffic to an FTP server by using its hostname only and deny all other traffic ?

Thanks

Antho

[MHM Cisco World]

You can use hostname not host IP in acl' 

You must be Sure that your router can resolve hostname to right IP

[M02@rt37]

Hello @anthodigbo,

yes you can.

The access-list host functionality permits the use of a hostname as per:

Router(config)#access-list 115 permit ip host ?

Hostname or A.B.C.D  Source address

So assuming the router can resolve DNS then it should be possible to use a DNS host name in an ACL.

[anthodigbo]

Hi,

Thanks for your response

I misunderstood what the teacher told us to do, I thought that it was possible to allow to connect to an FTP server by its hostname and in the meantime to deny to reach it out by its IP, but what I have been asked to, it's to allow to connect to the ftp server by the hostname and deny all other traffic to the ftp server like ICMP.

Thanks

[MHM Cisco World]

ip access-list extended MHM 
permit tcp <IP> <FTP hostname> eq 20
permit tcp <IP> <FTP hostname> eq 21
deny ip any any 
!
interface 
ip acess-group MHM in

[anthodigbo]

Thanks,

I'm dealing with IPv6, without the ACL I can connect with both IP or hostname

So far I've tried this :

ipv6 access-list NAME
permit tcp any host IP eq 53
permit tcp any host IP eq 20
permit tcp any host IP eq 21
end

When I apply the ACL, I'm still able to connect to the FTP with the IP, but not able to connect with the hostname and I've did not deny anything.

[MHM Cisco World]

what is meaning of "host IP" you use in ACL

[anthodigbo]

I have managed to do it like this:

ipv6 access-list NAME
permit udp any host IP eq 53
permit tcp any host IP eq 53
permit tcp any host IP eq 20
permit tcp any host IP eq 21
end

Thanks

[MHM Cisco World]

You are so welcome