topic Re: Domain object based rules are inconsistent in Cloud Firewall

Domain object based rules are inconsistent

abihsot__ — Wed, 26 Jul 2023 13:21:35 GMT

Hello,

We have Checkpoint network security gateways deployed in AWS using GWLB deployment (R80.40).

I noticed that firewall rules which are using domain objects are not consistent. For example if I allow access to google.com, server resolves to 142.250.186.46.

Then I verify on each gateway:

GW1:

domains_tool -ip 142.250.186.46
---------------------------------------------------------------------------------------------------
| Given IP address: 142.250.186.46 |
---------------------------------------------------------------------------------------------------
| Domain name | FQDN |
---------------------------------------------------------------------------------------------------
| google.com | yes |
---------------------------------------------------------------------------------------------------
Total of 1 domains found

GW2:

domains_tool -ip 142.250.186.46
No information about the IP address

GW3:

domains_tool -ip 142.250.186.46
No information about the IP address

All of the gateways are in the same region and point to the same DNS server.

How can I make sure each GW maintain accurate collection of IPs?

Re: Domain object based rules are inconsistent

PhoneBoy — Wed, 26 Jul 2023 16:11:36 GMT

I'd check a couple of SKs here:

Passive DNS Learning (may be useful): https://support.checkpoint.com/results/sk/sk161612
Troubleshooting with domains_tool: https://support.checkpoint.com/results/sk/sk161632

Re: Domain object based rules are inconsistent

the_rock — Wed, 26 Jul 2023 16:14:43 GMT

One time I had this issue with the customer, we disabled/re-enabled the rule, installed policy and failed. Then, after some time, TAC told us to do the same, but disable accelerated policy push and that worked.

I dont know, maybe we got lucky, but never happened after that.

Re: Domain object based rules are inconsistent

abihsot__ — Fri, 28 Jul 2023 07:56:30 GMT

Thanks. Passive DNS might be difficult to achieve, since each resource point to AWS dns and this traffic won't pass through gateways.