topic Re: Domain object not-FQDN in Firewall and Security Management

Domain object not-FQDN

Fabio_Bucci1 — Fri, 09 Mar 2018 10:20:37 GMT

Hi all,

It seems domain objects not-FQDN still not working in R80.10 management. I performed only management server migration and my gateways are still R77.30 (I'm not able to use FQDN domain objects indeed).

Anybody is facing the same issue?

Thanks,

Fabio

Re: Domain object not-FQDN

Kaspars_Zibarts — Fri, 09 Mar 2018 16:41:12 GMT

Can you provide a little bit more detail of what exactly is not working? Remember since gateways are R77 then you may only use old school domain object that uses reverse lookup, stops acceleration and only will apply one IP address in case it resolves to many IPs. That's by design.

Re: Domain object not-FQDN

Fabio_Bucci1 — Tue, 13 Mar 2018 08:54:14 GMT

Hi Kaspars,

I need a policy that should match against a sub-domain object (for example mail.example.com, mail2.example.com, smtp.example.com) and for this reason I created a domain object as ".example.com" (non-FDQN object) following the official guide. Further, it's not reported in order to work it properly also security gateway must be R80 version.

Domain Objects in R80.10 and above (Non-FQDN Mode section)

Traffic is dropped and don't match that rule.

Bye

Re: Domain object not-FQDN

Kaspars_Zibarts — Tue, 13 Mar 2018 10:58:33 GMT

You might want to check this SK Rules containing domain objects bypassed in rulebase or this How do Domain Objects work?

It most likely covers your scenario for pre R80.10 domain objects