topic Re: Domain object is not working in R80.10 properly in General Topics

Domain object is not working in R80.10 properly

Jubish_Ramakris — Wed, 04 Apr 2018 13:56:22 GMT

Dear Team,

I have added domain object in a rule (non-fqdn) and it is not working properly in checkpoint R80.10

The requirement was for O365.com

As it was not working I have tried with fqdn as well and still, the issue is same.

Added domain objects for all related URLs (eg. microsoft.com etc.), but no luck.

Did reverse nslookup as well and added the obtained domains.

Traffic is not hitting the particular rule.

As per the clean-up rule drop, in the tracker, the traffic is trying to reach the IP address for O365 server and our domain object is not able to resolve that.

When we added a rule with O365 IP addresses, the traffic is passing via that rule.

We are facing similar issues with some other URLs as well.

Is it a known issue with R80.10?

Is there any alternate methods or any dependencies for domain objects?

Re: Domain object is not working in R80.10 properly

Kaspars_Zibarts — Wed, 04 Apr 2018 17:20:14 GMT

It works for us perfectly as described in this sk

Domain Objects in R80.10 and above

Read it carefully. FQDN myst be specific (*.something will not work)

Also make sure that DNS resolution works on the gateway

Re: Domain object is not working in R80.10 properly

Gaurav_Pandya — Wed, 04 Apr 2018 17:41:24 GMT

Hi,

Please refer below Doc as well.

https://community.checkpoint.com/docs/DOC-2339-dynamic-objects-in-r8010

Re: Domain object is not working in R80.10 properly

Vincent_Bacher — Wed, 04 Apr 2018 20:34:37 GMT

(*.something will not work)

For *.something I assume you need application control.

Re: Domain object is not working in R80.10 properly

PhoneBoy — Wed, 04 Apr 2018 23:05:49 GMT

Domain objects in general do not require Application Control.

However, Application Control is useful in allowing access to Office 365.

Screenshots of exactly what you've tried to configure would be helpful.

Re: Domain object is not working in R80.10 properly

Vincent_Bacher — Thu, 05 Apr 2018 04:25:00 GMT

I meant wildcards, not domain objects in general.

Re: Domain object is not working in R80.10 properly

Kaspars_Zibarts — Thu, 05 Apr 2018 04:44:51 GMT

Remember there are other options if you don't have access to AC blade. There are number of scripts available that can generate IPs for O365 so you can stick with old school FW rules.

Just search community for O365.