Create a Post
Showing results for 
Search instead for 
Did you mean: 

Domain Filtering

We have multiple external facing URLs are that all resolve to the same public IPs. 

There is path-based routing configured on these URLs, each routed to a different site. i.e.,,,

We need to block access to some of these URLs from specific internal source networks, but allow access to others i.e. allow access to,, but block access to, 

I added FQDN domain objects (only traffic to the exact domain is matched on the rule) for, So only traffic to and should be matched on those objects. Traffic to the other domains i.e. should not be matched.

To match a rule with a FQDN domain object, the Security Gateway does name resolution using direct DNS query. The resolved IP addresses are cached, and traffic to those IP addresses are matched on the rule using that FQDN object.

However, this was also dropping traffic to, domains.

Can any one outline why this is occurring and if there is a way to circumvent this?  

Keep in mind, all of these sub-domains are resolving to the same public IPs.  



0 Kudos
2 Replies

FQDN Objects are working as expected here.
To properly differentiate between hosts on the same IP, you'll need Application Control and HTTPS Inspection.

0 Kudos

I assume it is running on HTTPS? Doing any HTTPS inspection? Or you do the 'light' version (only checking certificates).

With light you can only see the name of the certificate. This could give behavior you describe now. 

If you like this post please give a thumbs up(kudo)! 🙂
0 Kudos


Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events