Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Short of using static IP addresses, is it possible to have a Cisco ASA use a DNS name rather than an IP address? For instance, if I want to limit a host in the DMZ to access only one particular web service, but that web service might be globally load balanced or using DynDNS or cloud, how can the ACL be expressed so that a fixed IP address isn't used and the admin doesn't have to keep opening and closing down IP addresses?

share|improve this question

migrated from Apr 13 '10 at 1:06

This question came from our site for professional and enthusiast programmers.

It is possible to filter the traffic based on URL; however, this does not rely on DNS but on the HTTP Host header sent by your DMZ server. This also assumes that the traffic is cleartext and not sent over SSL.

Cisco provides a description of how to analyze HTTP request headers for filtering.

The ASA does not provide a facility to control traffic based on DNS name as far as I know.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.