• I have a cisco ASA-5505 configured to route internal network traffic " via tunnel - gateway IP is with the following:

route inside 1

  • I would need to configure the gateway using a Hostname "FQDN" as the hostname IP is always changing, when checked I found that route accepts Hostname:

route inside ?

configure mode commands/options: Hostname or A.B.C.D The address of the gateway by which the foreign network is reached.


My problem is each time I add the hostname or any hostname like "host.cisco.com" I received the error ---> ERROR: % Invalid Hostname

  • DNS is configured and I can ping any host, also created a object network for the hostname and fqdn but still receive the same error

  • How to configure route using a hostname as a gateway, any examples?


  • Besides Configuring the DNS Server, did you set the dns-group for the tunnel-group?
    – Ron Maupin
    May 28 '16 at 15:59
  • dns-group DefaultDNS is the only dns-group I have:
    – Hany Hana
    May 28 '16 at 16:16
  • "Specifies the DNS server group that the ASA uses for outgoing requests. Other DNS server groups can be configured for VPN tunnel groups. See the tunnel-group command in the command reference for more information."
    – Ron Maupin
    May 28 '16 at 16:17
  • Can you provide more details on how to configure DNS server group for VPN tunnel - there is a tunnel-group type ipsec-l2l - I'm not sure if I was clear - I want to change the gateway of the inside network from the tunnel IP: and replace it with a FQDN so it would be -> route inside dns-remote.com but when I do that I receive -> "ERROR: % Invalid Hostname"
    – Hany Hana
    May 28 '16 at 18:38
  • Is that DNS name actually in the DNS server that you use? How does the DNS server update the address when it changes? You really need to edit your question to include the ASA configuration, and show what it is your are trying to change.
    – Ron Maupin
    May 28 '16 at 18:42

If you enter a hostname, it will be resolved on the spot and stored as the address to which it resolved at that point in time. You cannot route to a dynamic destination via a hostname. (in fact, that doesn't work on ANY platform) The only way to route to a moving target is via an active routing protocol (RIP, OSPF, etc.), or a scripted process (the way SLIP/PPP/DHCP are handled)

  • Alright, your logic make sense but forget about the fact that this hostname is changing IPs "consider it sticks with one IP", now can I use the hostname to create a static route via it - what makes me say this is a hostname option is valid in -> route inside... - so if it is valid as a static route option it would not probably need a dynamic routing protocol (RIP, OSPF,...)
    – Hany Hana
    May 28 '16 at 21:14
  • 1
    How many ways can I say it? It does accept a hostname as valid input, however, it is resolved ONCE, right then. Do you expect it to lookup the address once per second and update the route table? That's the job of a dynamic routing protocol.
    – Ricky
    May 29 '16 at 4:51
  • @RickyBeam A FQDN is resolved per the TTL provided by the DNS server, not once. Enter show dns on the ASA to see the values. Jul 28 '16 at 2:44

Cisco ASA Series Command Reference, A - H Commands

CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5

poll-timer minutes number

The time, in minutes, of the polling cycle used to resolve FQDN network/host objects to IP addresses. FQDN objects are resolved only if they are used in a firewall policy. The timer determines the maximum time between resolutions; the DNS entry's time-to-live (TTL) value is also used to determine when to update to IP address resolution, so individual FQDNs might be resolved more frequently than the polling cycle. The default is 240 (four hours). The range is 1 to 65535 minutes.

dns expire-entry-timer

To remove the IP address of a resolved FQDN after its TTL expires, use the dns expire-entry-timer command in global configuration mode. To remove the timer, use the no form of this command.

dns expire-entry-timer minutes minutes

no dns expire-entry-timer minutes minutes

Syntax Description

minutes minutes

Specifies the timer time in minutes. Valid values range from 1 to 65535 minutes.


By default, the DNS expire-entry-timer value is 1 minute.

If none of that works, look at EEM to maybe clear your DNS cache automatically, or something like that to force an update.

  • This has f*** all to do with a route entry -- and in fact, almost everywhere a hostname is accepted. I've explained exactly how this works. Get an ASA and try it yourself before spouting BS from the CLI guide. Also, 9.5 isn't supported on a 5505. (not that he's stated what version it's running.)
    – Ricky
    Jul 28 '16 at 5:44
  • @RickyBeam You get angry every time I show you something new. Why have that attitude? You certainly must know that you have a lot to learn? #1 Configuring Objects 9.2 Supported on 5505 #2 Configuring Static Route Tracking via Object Jul 28 '16 at 15:46
  • Because you are more often wrong than remotely on target, and you absolutely refuse to accept the reality of the universe we all live in. If you use a hostname in a route command, it will resolve once, right then, and store the address not the hostname. If you've ever used anything, you'd know this. The only way to make it work is via a script to re-insert the route when the dns name changes. (detecting that change is a different mess) Also note, all docs on route specify numbers not names.
    – Ricky
    Jul 28 '16 at 19:01
  • Assuming the route add command on a ASA will not allow you to point to an object, why could you not route-map next-hop matching default to the object (the FQND)? Also, IP SLA on PIX "The target can be any network object that you choose". You're saying an object cannot be used for routing purposes? And, that "show dns" is unrelated to FQDN's in the ASA? Jul 28 '16 at 19:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.