Using hostnames in IP access lists
When I was configuring the access list that should prevent spammers from misusing my workstations, I obviously had to figure out the IP address of the ISP’s SMTP server (access lists and object groups accept IP addresses). I almost started nslookup on my Linux workstation, but then decided to try entering a hostname in an IOS ACL … and it works. Unfortunately, IOS performs a DNS lookup when you enter the hostname (assuming you have configured the ip name-server) and stores the resulting IP address in the ACL definition:
rtr(config)#ip access-list extended InsideList
rtr(config-ext-nacl)#permit tcp any host smtp.example.com eq smtp
Translating "smtp.example.com"...domain server (192.168.0.1) [OK]
rtr(config-ext-nacl)#do show access-list InsideList
Extended IP access list InsideList
10 permit tcp any host 192.168.2.3 eq smtp
You can enter hostnames in ACLs or network object groups. In both cases, the name is immediately translated into an IP address.
"Unfortunately, IOS performs a DNS lookup when you enter the hostname..."
I'm not sure why you prefaced that statement with "unfortunately". Surely you don't want IOS to put the hostname in the ACL and do a reverse DNS lookup on every packet entering/exiting your interface to see if it matches, right?
The behavior is the same as any, I think, any other device I've used in a similar fashion. Why the "unfortunately"? Maybe I am missing something?
The "trick" is nice, and it's working in your case now. But what if the server is using some round-robin technology? Your router will put into ACL the first IP which is resolved, but maybe second time another IP will be delivered and since this is not matched, the packets will be discarded. Am I right?
Overall nice blog and very interesting posts. I will comment some of them if I may :)
Good luck!