topic Re: Confusion on what is supported in R80.20+ for FQDN. in General Topics

Confusion on what is supported in R80.20+ for FQDN.

Aaron_Wrasman — Mon, 09 Dec 2019 16:41:52 GMT

So we recently moved a few of our firewalls to R80.20+ (i.e. we are still upgrading to R80.30 from R80.20)

We are trying to start using the FQDN feature of domain objects for normal firewall traffic.

I'm trying to allow access to sftp and not a website.

If my destination is something like www.vanityname.net and I can create a Domain object like:

.vanityname.net and make sure the FQDN feature is checked.

Put that as the destination in a normal firewall rule and it works.

If I have a site like sftp.vanityname.net and I create:

.sftp.vanityname.net

and make sure the FQDN feature is checked.

Put that as the destination in a normal firewall rule and it works sometimes.

Are only second level domains supported with the FQDN feature? (i.e. name.com but not sub.name.com )

And to be very clear I'm not talking wildcard domain names.

Re: Confusion on what is supported in R80.20+ for FQDN.

_Val_ — Mon, 09 Dec 2019 21:30:05 GMT

@Aaron_Wrasman , .sftp.vanityname.net should work. If it does not, please try troubleshooting and/or opening a support call

Re: Confusion on what is supported in R80.20+ for FQDN.

Aaron_Wrasman — Mon, 09 Dec 2019 23:54:23 GMT

What would you suggest for troubleshooting?

Re: Confusion on what is supported in R80.20+ for FQDN.

G_W_Albrecht — Tue, 10 Dec 2019 11:10:12 GMT

Open a SR# with TAC...

Re: Confusion on what is supported in R80.20+ for FQDN.

_Val_ — Tue, 10 Dec 2019 11:10:33 GMT

@Aaron_Wrasman name resolution for this specific object on your FW for starters

Re: Confusion on what is supported in R80.20+ for FQDN.

Aaron_Wrasman — Tue, 10 Dec 2019 17:08:40 GMT

Did that. It isn't supported.

Re: Confusion on what is supported in R80.20+ for FQDN.

Matthias_Haas — Tue, 10 Dec 2019 18:12:06 GMT

you could test with

domains_tool -d sftp.vanityname.net

on the cli of the GW to see which IPs that objects has (if any)

test it without the preceding period and you may have to run this command a couple of times to get a result

Re: Confusion on what is supported in R80.20+ for FQDN.

CPRQ — Tue, 10 Dec 2019 20:36:17 GMT

domain_tool did not give any IP, but dig command give the IP
[Expert@fwgb:2]# domains_tool -d 53.com
Domain is not attached to any IP address
[Expert@fwg-b:2]# dig @10.110.10.1 53.com
;; ANSWER SECTION:
53.com. 20 IN A 104.100.23.146

Re: Confusion on what is supported in R80.20+ for FQDN.

CPRQ — Tue, 10 Dec 2019 20:43:00 GMT

If I did correctly, did not get IP with domain_tool command, but got the IP with dig command.

Re: Confusion on what is supported in R80.20+ for FQDN.

Aaron_Wrasman — Tue, 10 Dec 2019 20:51:07 GMT

domains_tools is looking at the FQDN objects you have deployed in your policies on that particular gateway.

Do you have a domain object setup as .53.com and have the FQDN option turned on?

And then have that object in an enabled rule in your policies on that gateway?

Re: Confusion on what is supported in R80.20+ for FQDN.

CPRQ — Tue, 10 Dec 2019 20:59:38 GMT

Thank you, yes it worked when I pick object used in policy.