Domain Object

[handiansudianto]

Hello,

I make a test rule to allowing one server access to ww.detik.com, i create domain object with .detik.com

But i think the domain object is not working, the server still can't access to the www.detik.com, tick and untick the FQDN on the domain object not helping. 

Anyone know how about this?

[G_W_Albrecht]

As you do not show the rule created and the object in detail it is very hard to help here. Did you follow https://support.checkpoint.com/results/sk/sk120633 ? Also read https://support.checkpoint.com/results/sk/sk90401

[handiansudianto]

Hi @G_W_Albrecht 

yes l already follow the reference article, and here i send my rule

Ticked or not the rule is not working

Result :

[G_W_Albrecht]

And which rule does match and drop the traffic, cleanup rule ? Why do you use Any service for the rule ?

[handiansudianto]

Yes the traffic dropped by cleanup rule. Since i only need the server access to some websites so i set the service as 'Any'.

It's wrong?

[PhoneBoy]

Non-FQDN objects require the ability to reverse-resolve the IP address to the relevant domain.
FQDN objects require a forward lookup on the relevant FQDN.
Have you confirmed the gateway can actually do this?
See also: https://support.checkpoint.com/results/sk/sk161632 (to troubleshoot)
Maybe also see if the following will help: https://support.checkpoint.com/results/sk/sk161612 

[handiansudianto]

Hello,

Yes the gateway can do forward lookup.

When issuing command domain_tool -d www.detik.com i got 'Domain is not attached to any IP address'

[PhoneBoy]

Recommend engaging with the TAC here: https://help.checkpoint.com

[Daniel_3]

Is the source IP of the server also correct?
Recent policy install was done too? - Can check with "fw stat" on gateway.

[handiansudianto]

Hi..

yes, the policy already installed. Also i have another checkpoint and i do test by issuing 'domain_tool -d www.detik.com'

and this checkpoint showing ip address of detik.com but not for my 1st checkpoint.

[Daniel_3]

Did you already try 'domains_tool -report' from sk161632?

[handiansudianto]

i got 'WSDNSD and DNS servers are not synchronized' when issuing 'domains_tool -report'

This can be fixed by command below right? Will this command cause a downtime?

cpwd_admin stop -name WSDNSD -path "$FWDIR/bin/wsdnsd" -command "fw kill wsdnsd"; cpwd_admin start -name WSDNSD -path "$FWDIR/bin/wsdnsd" -command "wsdnsd"

[Daniel_3 · Accepted solution]

Restart of WSDNSD only impacts DNS resolution of the firewall itself and no other traffic. If you have multiple domain-objects and updatable objects I would do it outside of business hours (except if all of them don't work, then it does not matter).

If it is just this one domain you can do it any time.

[handiansudianto]

After restarting the WSDNSD now the domain object is working, but i still have a question about object domain.

I want to make domain object for this URL

ussus1eastprod.blob.core.windows.net
ussus2eastprod.blob.core.windows.net
ussus3eastprod.blob.core.windows.net
ussus4eastprod.blob.core.windows.net
wsus1eastprod.blob.core.windows.net
wsus2eastprod.blob.core.windows.net

and i make domain object with name .blob.core.windows.net and FQDN not ticked. On my mind domain object .blob.core.windows.net can discover all URL above but when i check with command domains_tool -d blob.core.windows.net and i just only get one ip address. Did you know why?

[PhoneBoy]

Because Domain Objects that aren't FQDN rely on reverse DNS to operate.
When I look up the IP I get for, e.g. wsus2eastprod.blob.core.windows.net, I get an NXDOMAIN (no record found) for the IP that it resolves to.
Recommend doing this with either a Custom Application/Site or put these hosts in a Network Feed in R81.20+.