We have a webserver (IIS) hosting some e-commerce websites. Our firewall in front of the server has a restriction on inbound and outbound traffic. The webserver makes outbound calls to payment providers (and other third party services) using DNS resolution and outbound traffic to those IPs are allowed by our firewall. Updates to the list of IPs we need to allow are published on their websites.

When the payment provider (or any other service our website is using) adds more servers to their solution, outbound calls to those new IPs will fail if they are not allowed by our firewall already.

The question: is there any way we can allow outbound access based on domain name (eg. paypal.com) instead of using a block of IPs, which don't always remain the same?

The firewall in front is made by Cisco.

Also, is there any other approach suitable for this kind of scenario?

thanks in advance


Starting with IOS version 8.4(2) you can use Identity-based access rules.

That is exactly what you are looking for.

There is also a support article on cisco's forum that details how to configure the DNS and access-list with FQDN.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.