We have multiple external facing URLs are that all resolve to the same public IPs.
There is path-based routing configured on these URLs, each routed to a different site. i.e. test.domain.com/demo, test2.domain.com/demo, test.domain.com/demo1, test2.domain.com/demo1
We need to block access to some of these URLs from specific internal source networks, but allow access to others i.e. allow access to test.domain.com, test2.domain.com, but block access to test3.domain.com, test4.domain.com
I added FQDN domain objects (only traffic to the exact domain is matched on the rule) for test.domain.com, test2.domain.com. So only traffic to test.domain.com and test2.domain.com should be matched on those objects. Traffic to the other domains i.e. test3.domain.com should not be matched.
To match a rule with a FQDN domain object, the Security Gateway does name resolution using direct DNS query. The resolved IP addresses are cached, and traffic to those IP addresses are matched on the rule using that FQDN object.
However, this was also dropping traffic to test3.domain.com, test4.domain.com domains.
Can any one outline why this is occurring and if there is a way to circumvent this?
Keep in mind, all of these sub-domains are resolving to the same public IPs.
Regards,
Simon
