I'm working on an Aruba 2900 series switch and I'd like to restrict any traffic except traffic from/to a handful of domain names.

What I have to far:

ip access-list extended "production"

deny ip any any
permit // Allow internal traffic
permit *.mydomain.local // Is this possible?

I was unable to find anything regarding the use of domain names in the documentation of Aruba/HPE

Is this possible? And if so, how can I achieve this?

  • Names are not part of IP, which only uses addresses.
    – Ron Maupin
    Oct 15, 2020 at 13:38
  • *.mydomain.local is not a domain name, it's a wildcard. foo.mydomain.local is a name, and it can be used in various places -- when it gets resolved to a number varies, but I'm not aware of any routing platform that will do DNS lookups during ACL checks.
    – Ricky
    Oct 15, 2020 at 22:13

1 Answer 1


No. At least not directly.

Domain names are a concept on the application layer. ACLs work in the network layer (simple ACLs) and in the transport layer (extended ACLs), so they can't see any names - just IP addresses and TCP/UDP port numbers.

If you resolve the unwanted host names to IP addresses, then you can add those IP addresses to ACL rules and block all traffic to them. Note that each ACL has an implicit deny any any at its end. If you deny some traffic and want to permit everything else you'll need a permit any any as the last line.

  • Just as I suspected. Thanks for your answer
    – user70842
    Oct 15, 2020 at 19:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.