Access-list - Hostname as source

[Tauer Drumond]

Hi all,

I have an ASA 5540 and I'd like to create a rule using a specific host name as source of the traffic, not an ip address.

Is that possible?

My firewall already resolves names to IP address so I can ping all my internal hosts by name

Thanks

Tauer

[John Blakley · Accepted solution]

It's not possible unfortunately. If this is an address that resolves to an internet hostname, you'll need to run nslookup on that hostname to get the addresses. You can then create an object-group for ease of management. (It *might* work on the new IOS version, but I'm running 8.0x and it doesn't work.)

Example:

Hostname: bing.com

nslookup bing.com

1.1.1.1

2.2.2.2

object-group network bing.com

network host 1.1.1.1

network host 2.2.2.2

access-list INSIDE permit ip any object-group bing.com

That's the only way that I know you'd be able to do it.

The firewall will translate addresses from the CLI, but it won't do it for your hosts.

HTH,

John

[Tauer Drumond]

Hi John,

thank you so much!