ASA 8.4.4 filter url using hostname
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-07-2012 02:50 PM - edited 03-11-2019 04:39 PM
Hello ... is there any way to apply hostname or object network in the syntax?
The command gives the option to use hostname or A.B.C.D but doesn't accept the hostname
PIX1(config)# filter url except 0.0.0.0 0.0.0.0 ?
configure mode commands/options:
Hostname or A.B.C.D The address of foreign/external host which is
destination for connections requiring filtering
Can an FQDN be used as a foreign/external host?
Thanks.
- Labels:
-
NGFW Firewalls
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-07-2012 11:56 PM
Hi,
I'm not sure if I have every used the command you are using in your example. Is it related to using an external server for the filtering?
There is though an option to use FQDN on the access-list if you are running atleast 8.4(2) on the ASA
For example a Facebook block could be configured like this
dns domain-lookup outside
DNS server-group DefaultDNS
name-server x.x.x.x
name-server y.y.y.y
object network FACEBOOK-FQDN
fqdn www.facebook.com
access-list INSIDE-IN remark Block Facebook
access-list INSIDE-IN extended deny ip any object FACEBOOK-FQDN
Then again the above configuration would not completely block Facebook for example since the destination address keeps changing. (Would have to resort to dropping the HTTP connections, dropping the DNS replys, dropping the traffic on the basis of the destination IP address etc.
- Jouni
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-08-2012 12:25 AM
This feature is very good explained in a supportforum-doc:
https://supportforums.cisco.com/docs/DOC-17014
--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-08-2012 05:35 AM
Thank y ou Jouni and Karsten. I'm aware of the use in access-lists but was hoping there was some way to apply the fqdn feature to the filter url command.
