up vote 0 down vote favorite
share [g+] share [fb]

I got a CISCO 1800 router. I want to allow a particular domain only. Its clustered so I dont know what the IP address is.

UPDATE

Here is what I need. In cisco routers, I can set the ACL to allow a particular IP. I am setting this up for a corporate using this guide:

http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml

For IPs I set something like:

access-list acl_permit permit ip 192.168.32.0 0.0.7.255

However, for some sites which I do not want to block, I need to allow particular domains. So I dont want to enter the IP address in the command. How do I go about doing that? Any ideas?

link|improve this question
80% accept rate
1  
wow...just...wow – Chopper3 May 7 '10 at 9:37
1  
Your question doesn't mean anything. Please describe "I want to allow a particular domain only" – radius May 7 '10 at 11:40
Using ACL I want to allow a particular domain. The regular commands allow me to allow IPs but not domains. – elated May 7 '10 at 13:26
You mean something like permit www.google.com ? if yes do you want to filter only access to website or other kind of flow (smtp, ...) ? – radius May 7 '10 at 15:55
I've down-voted this until you can clarify what you're trying to do; your question is too ambiguous right now. – gravyface May 7 '10 at 16:01
show 1 more comment
feedback

2 Answers

up vote 1 down vote accepted

I am guessing by domain you mean a Windows domain? I am not aware of anything that does this, might be possible by using acls obtained from radius attributes, with a script that generates those radius ACLs based on the domain's properties. That being said, I don't think that would be a good idea. That would be too much integration in my mind for security and practical reasons.

If you mean good old dns, networking doesn't really work like that. Clients accessing say webpage resolve the IP before they send the web request. So the requests are not going to a domain when they reach a router, rather an IP (I'm ignoring HTTP headers and such, but that will just be more confusing).

You generally want to build your ACLs based on UDP/TCP ports and IPs for the most part. I recommend you read a intro Cisco book that not only covers Cisco itself, but how fundamental networking works. Perhaps a good book might be Sybex CCNA. Administering routers with these fundamentals is generally pretty dangerous.

link|improve this answer
feedback
up vote 0 down vote

You're probably better off implementing WCCP to a filtering proxy than to try to (ab)use the ACL mechanism. The ACLs work on layer 3 (or layer 2, if they're MAC-level ACLs) and have no notion of "domain name". On higher-end routers, the ACLs get compiled into ASIC configuration and will run in programmable hardware rather than be interpreted. Forcing a high-end router to do a DNS lookup frequently (would have to be for every packet to be 100% accurate) would absolutely kill the performance.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.