ASA ACL using FQDN with Wildcard

[John Jenard Valencia]

Im new to firewalling and im currently trying to allow traffic from Office 365 on our Cisco ASA 5515-X

Is the a way to use FQDN with wildcard (ex. *.office365.com)

There are numerous destinations similar to the example to allow Office365.

[Karsten Iwen]

No, that won't work. The ASA uses the FQDNs to resolve them to an IP address. These IPs are used for access-control. With wildcards, the ASA doesn't know what to resolve.

[John Jenard Valencia]

Thank you for the information Karsten Iwen

is there any alternative to achieve using destination with wildcards?

Although Microsoft provided all the IPs used by Office365, its many compared to FQDN just in case.

[Karsten Iwen]

Solutions that inspect the payload can do that like the FirePower module that you can install in your ASA. But that works best with clear communication and is an extra effort for encrypted communication like HTTPS.

[Alex Pfeil]

In this example *.office365.com, you just put office365.com and that matches all of the wildcards. I tested this out with a pretty long list of FQDNs, and the test came back successful.

[subhasish.p]

does this work as ASA or FTD proactively matches the IP address to the FQDN ( as defined in the ACL ) and there wouldnt not be able to match to any IP for any office365.com ( or its subdomain ) unless its FQDN .

Please let me know what is output do you see for show FQDN or show DNS on your device for office365.com .