topic . in Firewall and Security Management

.

Mk_83 — Fri, 30 Aug 2024 03:54:53 GMT

Re: CheckPoint FW resolved SharePoint’s IP Address as blacklist domain

AkosBakos — Thu, 29 Aug 2024 12:44:37 GMT

Hi @Mk_83

What are the configured DNS servers for your cluster?

IP: 10.17.173.5

Akos

Re: CheckPoint FW resolved SharePoint’s IP Address as blacklist domain

the_rock — Thu, 29 Aug 2024 13:46:11 GMT

Thats what came to my mind as well...dns, can you confirm?

Andy

Re: CheckPoint FW resolved SharePoint’s IP Address as blacklist domain

PhoneBoy — Thu, 29 Aug 2024 19:12:30 GMT

For FQDN objects (which you're clearly using), the gateway periodically queries the configured DNS resolver to find its IP for proper enforcement in the Access Policy.
The Occam's Razor answer is, therefore, at least in your DNS resolver (if not globally), bierbuducunpderdr[.]ddns[.]net resolved to that IP.
Once that FQDN stopped resolving (it currently doesn't for me), the problem resolved.

How bierbuducunpderdr[.]ddns[.]net resolved to that IP would be a question for the folks who run DDNS (No-IP).