0

I'm working on an Aruba 2900 series switch and I'd like to restrict any traffic except traffic from/to a handful of domain names.

What I have to far:

ip access-list extended "production"

deny ip any any
permit 192.168.64.0 0.0.0.255 192.168.64.0 0.0.0.255 // Allow internal traffic
permit 192.168.64.0 0.0.0.255 *.mydomain.local // Is this possible?

I was unable to find anything regarding the use of domain names in the documentation of Aruba/HPE

Is this possible? And if so, how can I achieve this?

Improve this question
2
  • Names are not part of IP, which only uses addresses.
    – Ron Maupin ♦
    Oct 15, 2020 at 13:38
  • *.mydomain.local is not a domain name, it's a wildcard. foo.mydomain.local is a name, and it can be used in various places -- when it gets resolved to a number varies, but I'm not aware of any routing platform that will do DNS lookups during ACL checks.
    – Ricky
    Oct 15, 2020 at 22:13

1 Answer 1

Reset to default
0

No. At least not directly.

Domain names are a concept on the application layer. ACLs work in the network layer (simple ACLs) and in the transport layer (extended ACLs), so they can't see any names - just IP addresses and TCP/UDP port numbers.

If you resolve the unwanted host names to IP addresses, then you can add those IP addresses to ACL rules and block all traffic to them. Note that each ACL has an implicit deny any any at its end. If you deny some traffic and want to permit everything else you'll need a permit any any as the last line.

Improve this answer
1
  • Just as I suspected. Thanks for your answer
    – user70842
    Oct 15, 2020 at 19:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.