Home / server / Questions / 139517
Accepted
elated
Asked: 2010-05-08 01:22:48 +0800 CST

Cisco 1800 router allow specific domain only (variable IP)

  • 772

I got a CISCO 1800 router. I want to allow a particular domain only. Its clustered so I dont know what the IP address is.

UPDATE

Here is what I need. In cisco routers, I can set the ACL to allow a particular IP. I am setting this up for a corporate using this guide:

http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml

For IPs I set something like:

access-list acl_permit permit ip 192.168.32.0 0.0.7.255

However, for some sites which I do not want to block, I need to allow particular domains. So I dont want to enter the IP address in the command. How do I go about doing that? Any ideas?

router cisco

2 Answers

  1. Best Answer

    I am guessing by domain you mean a Windows domain? I am not aware of anything that does this, might be possible by using acls obtained from radius attributes, with a script that generates those radius ACLs based on the domain's properties. That being said, I don't think that would be a good idea. That would be too much integration in my mind for security and practical reasons.

    If you mean good old dns, networking doesn't really work like that. Clients accessing say webpage resolve the IP before they send the web request. So the requests are not going to a domain when they reach a router, rather an IP (I'm ignoring HTTP headers and such, but that will just be more confusing).

    You generally want to build your ACLs based on UDP/TCP ports and IPs for the most part. I recommend you read a intro Cisco book that not only covers Cisco itself, but how fundamental networking works. Perhaps a good book might be Sybex CCNA. Administering routers with these fundamentals is generally pretty dangerous.

    • 1

  2. You're probably better off implementing WCCP to a filtering proxy than to try to (ab)use the ACL mechanism. The ACLs work on layer 3 (or layer 2, if they're MAC-level ACLs) and have no notion of "domain name". On higher-end routers, the ACLs get compiled into ASIC configuration and will run in programmable hardware rather than be interpreted. Forcing a high-end router to do a DNS lookup frequently (would have to be for every packet to be 100% accurate) would absolutely kill the performance.

    • 0