Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Short of using static IP addresses, is it possible to have a Cisco ASA use a DNS name rather than an IP address? For instance, if I want to limit a host in the DMZ to access only one particular web service, but that web service might be globally load balanced or using DynDNS or cloud, how can the ACL be expressed so that a fixed IP address isn't used and the admin doesn't have to keep opening and closing down IP addresses?

share|improve this question

migrated from stackoverflow.com Apr 13 '10 at 1:06

This question came from our site for professional and enthusiast programmers.

add comment

1 Answer

It is possible to filter the traffic based on URL; however, this does not rely on DNS but on the HTTP Host header sent by your DMZ server. This also assumes that the traffic is cleartext and not sent over SSL.

Cisco provides a description of how to analyze HTTP request headers for filtering.

The ASA does not provide a facility to control traffic based on DNS name as far as I know.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.