FQDN destination natively supported R80+?

[JaySon_2021]

We have a number of outbound Internet rules that we have to update regularly due to the destination IP changing:

Ie: URL thiswebsite.com was 1.2.3.4 and then the remote site IP changed to 7.8.9.10

Which means we have go update the thiswebsite.com firewall object that we have.

Is URL/FQDN natively supported/permitted without a license in R80+?

meaning - I can create a URL object call thiswebsite.com and when the IP changes at the remote side I have no need to update my rule(s)?

[PhoneBoy · Accepted solution]

Yes, they are called Domain objects.
See https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...
Domain Objects are supported with the basic firewall license.

[the_rock]

Phoneboy said it right, you just need basic license to use domain objects, no need for anything special.

[Sorin_Gogean]

We're using Domain Objects since couple of years without a problem (we have ~500 objects). Just pay attention that in some cases (like 1 in 100 or 1000) there might be a situation that your client would resolve the domain to IP address 1.2.3.4 while the CheckPoint GW would resolve that same domain to 1.3.4.2 IP address . To be honest, we never encountered that, or at leas I was not aware in those couple of years we're using it....

So in order not to face that, make sure that the DNS servers used by your clients, will be same as your CheckPoint Gateways, like some internal DNS servers....

One other thing, the object definition has an option to perform reverse DNS in order to assure that the IP resolves to the domain and vice-versa, still with cloud these days, the revers does not match.... so pay attention to that part.

Thank you,

[PhoneBoy]

Even in the 90s, Reverse DNS didn't always match up very well 🙂