Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
JaySon_2021
Participant
Jump to solution

FQDN destination natively supported R80+?

We have a number of outbound Internet rules that we have to update regularly due to the destination IP changing:

Ie: URL thiswebsite.com was 1.2.3.4 and then the remote site IP changed to 7.8.9.10

Which means we have go update the thiswebsite.com firewall object that we have.

Is URL/FQDN natively supported/permitted without a license in R80+?

meaning - I can create a URL object call thiswebsite.com and when the IP changes at the remote side I have no need to update my rule(s)?

 

 

0 Kudos
1 Solution

Accepted Solutions
PhoneBoy
Admin
Admin

Yes, they are called Domain objects.
See https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...
Domain Objects are supported with the basic firewall license.

View solution in original post

4 Replies
PhoneBoy
Admin
Admin

Yes, they are called Domain objects.
See https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...
Domain Objects are supported with the basic firewall license.

the_rock
Legend
Legend

Phoneboy said it right, you just need basic license to use domain objects, no need for anything special.

0 Kudos
Sorin_Gogean
Advisor

We're using Domain Objects since couple of years without a problem (we have ~500 objects). Just pay attention that in some cases (like 1 in 100 or 1000) there might be a situation that your client would resolve the domain to IP address 1.2.3.4 while the CheckPoint GW would resolve that same domain to 1.3.4.2 IP address . To be honest, we never encountered that, or at leas I was not aware in those couple of years we're using it....

So in order not to face that, make sure that the DNS servers used by your clients, will be same as your CheckPoint Gateways, like some internal DNS servers....

 

One other thing, the object definition has an option to perform reverse DNS in order to assure that the IP resolves to the domain and vice-versa, still with cloud these days, the revers does not match.... so pay attention to that part.

 

Thank you,

0 Kudos
(1)
PhoneBoy
Admin
Admin

Even in the 90s, Reverse DNS didn't always match up very well 🙂

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events