Domain Filtering

[Simon_Macpherso]

We have multiple external facing URLs are that all resolve to the same public IPs. 

There is path-based routing configured on these URLs, each routed to a different site. i.e. test.domain.com/demo, test2.domain.com/demo, test.domain.com/demo1, test2.domain.com/demo1

We need to block access to some of these URLs from specific internal source networks, but allow access to others i.e. allow access to test.domain.com, test2.domain.com, but block access to test3.domain.com, test4.domain.com 

I added FQDN domain objects (only traffic to the exact domain is matched on the rule) for test.domain.com, test2.domain.com. So only traffic to test.domain.com and  test2.domain.com should be matched on those objects. Traffic to the other domains i.e. test3.domain.com should not be matched.

To match a rule with a FQDN domain object, the Security Gateway does name resolution using direct DNS query. The resolved IP addresses are cached, and traffic to those IP addresses are matched on the rule using that FQDN object.

However, this was also dropping traffic to test3.domain.com, test4.domain.com domains.

Can any one outline why this is occurring and if there is a way to circumvent this?  

Keep in mind, all of these sub-domains are resolving to the same public IPs.  

Regards,

Simon

[PhoneBoy]

FQDN Objects are working as expected here.
To properly differentiate between hosts on the same IP, you'll need Application Control and HTTPS Inspection.

[Lesley]

I assume it is running on HTTPS? Doing any HTTPS inspection? Or you do the 'light' version (only checking certificates).

With light you can only see the name of the certificate. This could give behavior you describe now.