topic Re: Domain Object in Firewall and Security Management

Domain Object

handiansudianto — Tue, 22 Aug 2023 08:30:45 GMT

Hello,

I make a test rule to allowing one server access to ww.detik.com, i create domain object with .detik.com

But i think the domain object is not working, the server still can't access to the www.detik.com, tick and untick the FQDN on the domain object not helping.

Anyone know how about this?

Re: Domain Object

G_W_Albrecht — Tue, 22 Aug 2023 08:45:04 GMT

As you do not show the rule created and the object in detail it is very hard to help here. Did you follow https://support.checkpoint.com/results/sk/sk120633 ? Also read https://support.checkpoint.com/results/sk/sk90401

Re: Domain Object

handiansudianto — Tue, 22 Aug 2023 09:01:59 GMT

Hi @G_W_Albrecht

yes l already follow the reference article, and here i send my rule

Ticked or not the rule is not working

Result :

Re: Domain Object

G_W_Albrecht — Tue, 22 Aug 2023 09:16:59 GMT

And which rule does match and drop the traffic, cleanup rule ? Why do you use Any service for the rule ?

Re: Domain Object

PhoneBoy — Tue, 22 Aug 2023 13:40:45 GMT

Non-FQDN objects require the ability to reverse-resolve the IP address to the relevant domain.
FQDN objects require a forward lookup on the relevant FQDN.
Have you confirmed the gateway can actually do this?
See also: https://support.checkpoint.com/results/sk/sk161632 (to troubleshoot)
Maybe also see if the following will help: https://support.checkpoint.com/results/sk/sk161612

Re: Domain Object

handiansudianto — Wed, 23 Aug 2023 00:39:42 GMT

Yes the traffic dropped by cleanup rule. Since i only need the server access to some websites so i set the service as 'Any'.

It's wrong?

Re: Domain Object

handiansudianto — Wed, 23 Aug 2023 00:44:48 GMT

Hello,

Yes the gateway can do forward lookup.

When issuing command domain_tool -d www.detik.com i got 'Domain is not attached to any IP address'

Re: Domain Object

Daniel_3 — Wed, 23 Aug 2023 07:09:30 GMT

Is the source IP of the server also correct?
Recent policy install was done too? - Can check with "fw stat" on gateway.

Re: Domain Object

handiansudianto — Wed, 23 Aug 2023 07:13:22 GMT

Hi..

yes, the policy already installed. Also i have another checkpoint and i do test by issuing 'domain_tool -d www.detik.com'

and this checkpoint showing ip address of detik.com but not for my 1st checkpoint.

Re: Domain Object

Daniel_3 — Wed, 23 Aug 2023 08:07:18 GMT

Did you already try 'domains_tool -report' from sk161632?

Re: Domain Object

handiansudianto — Wed, 23 Aug 2023 08:12:31 GMT

i got 'WSDNSD and DNS servers are not synchronized' when issuing 'domains_tool -report'

This can be fixed by command below right? Will this command cause a downtime?

cpwd_admin stop -name WSDNSD -path "$FWDIR/bin/wsdnsd" -command "fw kill wsdnsd"; cpwd_admin start -name WSDNSD -path "$FWDIR/bin/wsdnsd" -command "wsdnsd"

Re: Domain Object

Daniel_3 — Wed, 23 Aug 2023 09:25:39 GMT

Restart of WSDNSD only impacts DNS resolution of the firewall itself and no other traffic. If you have multiple domain-objects and updatable objects I would do it outside of business hours (except if all of them don't work, then it does not matter).

If it is just this one domain you can do it any time.

Re: Domain Object

PhoneBoy — Wed, 23 Aug 2023 19:17:20 GMT

Recommend engaging with the TAC here: https://help.checkpoint.com

Re: Domain Object

handiansudianto — Thu, 24 Aug 2023 01:09:28 GMT

After restarting the WSDNSD now the domain object is working, but i still have a question about object domain.

I want to make domain object for this URL

ussus1eastprod.blob.core.windows.net
ussus2eastprod.blob.core.windows.net
ussus3eastprod.blob.core.windows.net
ussus4eastprod.blob.core.windows.net
wsus1eastprod.blob.core.windows.net
wsus2eastprod.blob.core.windows.net

and i make domain object with name .blob.core.windows.net and FQDN not ticked. On my mind domain object .blob.core.windows.net can discover all URL above but when i check with command domains_tool -d blob.core.windows.net and i just only get one ip address. Did you know why?

Re: Domain Object

PhoneBoy — Thu, 24 Aug 2023 22:01:47 GMT

Because Domain Objects that aren't FQDN rely on reverse DNS to operate.
When I look up the IP I get for, e.g. wsus2eastprod.blob.core.windows.net, I get an NXDOMAIN (no record found) for the IP that it resolves to.
Recommend doing this with either a Custom Application/Site or put these hosts in a Network Feed in R81.20+.