Can I do this in an ASA?

[John Blakley]

All,

I'm converting from a Symantec Firewall (SF) to an ASA 5550. I've been looking through the ruleset on the SF, and I'm noticing that there are domain names listed as entities that reference another domain name.

This means that a firewall rule would, in ASA notation, look like:

permit ip host 5.5.5.5 host www.google.com.

name 10.10.10.10 www.google.com

I need the ASA to resolve to domain names to allow for traffic to domains that could possibly change ip addresses or have multiple ip addresses assigned to a domain name.

Is this possible?

Thanks,

John

[cisco24x7]

This is one of the many advantages that Symantec and CP firewalls have over Cisco.

The other features is the negation rule.

To my knowledge, it can not be done with ASA.

[John Blakley]

That's what I was afraid of. I think the only thing that I could do would be to create an object group and put the IPs that are registered to that domain in there.

[Collin Clark]

Cisco wants you to use a (their) proxy server to control access. However you can use regex to block sites.

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080940e04.shtml

Hope that helps.