FQDN access in ASA 5545

[AnjaliRawat0713]

We want to allow few clients machines to be able to connect directly to various subdomains (For eg :- xzy.com )

We need the firewall to allow clients to be able to connect to *.xzy.com domains names (rather than by IP address).
Is it possible in ASA 5545 version 9.1(7)4 

[balaji.bandi]

here is the good document to start with  :

https://community.cisco.com/t5/security-documents/using-hostnames-dns-in-access-lists-configuration-steps-caveats/ta-p/3123480

[AnjaliRawat0713]

Thank you for the response .

[AnjaliRawat0713]

The traffic flow I am looking is something below . Can you suggest regarding the NAT configuration when the DNS would resolve to different public IPs.

Client machine (multiple subnet) --> accessing FQDN (URL ) --> DNS would resolve those url's to public IP . 

[rdz586]

Hi Anjali,

I am pretty sure that ASA's cannot do wildcard FQDN's and you would have to add each FQDN into an object-group separately.

If the destination network has a list of static public IP addresses that it uses then you could permit the IP address range instead.

[AnjaliRawat0713]

Thankyou rdz586 for replying.

Yes wildcard is not supported. I need to define the FQDN into object group separately. The traffic flow I am looking is something below . Can you suggest regarding the NAT configuration when the DNS would resolve to different public IPs.

Client machine (multiple subnet) --> accessing FQDN (URL ) --> DNS would resolve those url's to public IP . 

[rdz586]

I assume you do not have a default NAT rule and you only NAT the traffic which is allowed by your access rules.

You can use the object-group with the FQDN to NAT the taffic:-

nat (INSIDE,OUTSIDE) source static Source_Group interface destination static FQDN_Group FQDN_Group service Port_Group Port_Group

The ports are optional if you only wanted certain traffic to be NAT'd out to the internet.

Hopefully I have understood your need and this helps out, please let me know if not.

[AnjaliRawat0713]

Thankyou rdz586 for the quick response.
We can onfigure FQDNs inside the objects but can't use them in a nat configuration, the ASA won't let you do it. It will even tell you that it's not supported .

Also regarding NAT part , dynamic PAT is being used for the inside interface.

object network inside_net_a.b.c.d
nat (inside,outside) dynamic interface 

Can you now please suggest about the configuration part now. 

[balaji.bandi]

yes you need to have DNS server to resolve basic start with for FQDN to work, yes *.bb.com not going to work. you need to have cisco.bb.com for resolution.