topic Blocking a resource by domain name in Firewall and Security Management

Blocking a resource by domain name

Nadezhda — Tue, 28 Nov 2023 10:32:58 GMT

Hello Team!

There is a need to block traffic from and to a resource by domain name.
We have created an access control rule with the FQDN object
The problem is that the resource is resolved to many ip addresses, and while Check Point sends a DNS query, half of the traffic is partially missed.

There is an option to increase TTL as described here https://support.checkpoint.com/results/sk/sk181215, but how effective will it be ?

Are there any other ways to completely deny traffic from a certain domain name and preferably with not too high load on the gateway ?

Also, we are interested in blocking by file resolution using blade ips, but I'm afraid that would be very resource intensive.

Re: Blocking a resource by domain name

G_W_Albrecht — Tue, 28 Nov 2023 11:19:26 GMT

sk90401: How are Domain Objects enforced by the Security Gateway?

sk181215: FQDN domain object cannot be matched

Re: Blocking a resource by domain name

PhoneBoy — Tue, 28 Nov 2023 15:51:17 GMT

The gateway must either see the DNS requests made by the client (Passive DNS Learning in R80.40+) OR use the same DNS servers the client does.
Otherwise, there will be differences in enforcement, as you are observing.

What do you mean by "blocking by file resolution using IPS" exactly?

Re: Blocking a resource by domain name

the_rock — Thu, 30 Nov 2023 03:50:15 GMT

There were few posts about this in the past and this is not sadly the optimal way of doing it. Should be done with urlf blade, as well as when https inspection is enabled. You can create domain object and use it in the rule, but in my experience, that may work randomly, as the fqdn itself may end up resolving to different IPs and they may change constantly.

Best regards,

Andy