topic Re: FQDN destination natively supported R80+? in General Topics

FQDN destination natively supported R80+?

JaySon_2021 — Tue, 29 Nov 2022 23:07:27 GMT

We have a number of outbound Internet rules that we have to update regularly due to the destination IP changing:

Ie: URL thiswebsite.com was 1.2.3.4 and then the remote site IP changed to 7.8.9.10

Which means we have go update the thiswebsite.com firewall object that we have.

Is URL/FQDN natively supported/permitted without a license in R80+?

meaning - I can create a URL object call thiswebsite.com and when the IP changes at the remote side I have no need to update my rule(s)?

Re: FQDN destination natively supported R80+?

PhoneBoy — Wed, 30 Nov 2022 02:30:35 GMT

Yes, they are called Domain objects.
See https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk120633&partition=Basic&product=Quantum
Domain Objects are supported with the basic firewall license.

Re: FQDN destination natively supported R80+?

the_rock — Wed, 30 Nov 2022 02:54:12 GMT

Phoneboy said it right, you just need basic license to use domain objects, no need for anything special.

Re: FQDN destination natively supported R80+?

Sorin_Gogean — Wed, 30 Nov 2022 07:00:38 GMT

We're using Domain Objects since couple of years without a problem (we have ~500 objects). Just pay attention that in some cases (like 1 in 100 or 1000) there might be a situation that your client would resolve the domain to IP address 1.2.3.4 while the CheckPoint GW would resolve that same domain to 1.3.4.2 IP address . To be honest, we never encountered that, or at leas I was not aware in those couple of years we're using it....

So in order not to face that, make sure that the DNS servers used by your clients, will be same as your CheckPoint Gateways, like some internal DNS servers....

One other thing, the object definition has an option to perform reverse DNS in order to assure that the IP resolves to the domain and vice-versa, still with cloud these days, the revers does not match.... so pay attention to that part.

Thank you,

Re: FQDN destination natively supported R80+?

PhoneBoy — Wed, 30 Nov 2022 18:37:29 GMT

Even in the 90s, Reverse DNS didn't always match up very well 🙂