Short of using static IP addresses, is it possible to have a Cisco ASA use a DNS name rather than an IP address? For instance, if I want to limit a host in the DMZ to access only one particular web service, but that web service might be globally load balanced or using DynDNS or cloud, how can the ACL be expressed so that a fixed IP address isn't used and the admin doesn't have to keep opening and closing down IP addresses?
migrated from stackoverflow.com Apr 13 '10 at 1:06
This question came from our site for professional and enthusiast programmers.
It is possible to filter the traffic based on URL; however, this does not rely on DNS but on the HTTP Host header sent by your DMZ server. This also assumes that the traffic is cleartext and not sent over SSL.
Cisco provides a description of how to analyze HTTP request headers for filtering.
The ASA does not provide a facility to control traffic based on DNS name as far as I know.