Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Simon_Macpherso
Advisor

Domain Filtering

We have multiple external facing URLs are that all resolve to the same public IPs. 

There is path-based routing configured on these URLs, each routed to a different site. i.e. test.domain.com/demo, test2.domain.com/demo, test.domain.com/demo1, test2.domain.com/demo1

We need to block access to some of these URLs from specific internal source networks, but allow access to others i.e. allow access to test.domain.com, test2.domain.com, but block access to test3.domain.com, test4.domain.com 

I added FQDN domain objects (only traffic to the exact domain is matched on the rule) for test.domain.com, test2.domain.com. So only traffic to test.domain.com and  test2.domain.com should be matched on those objects. Traffic to the other domains i.e. test3.domain.com should not be matched.

To match a rule with a FQDN domain object, the Security Gateway does name resolution using direct DNS query. The resolved IP addresses are cached, and traffic to those IP addresses are matched on the rule using that FQDN object.

However, this was also dropping traffic to test3.domain.com, test4.domain.com domains.

Can any one outline why this is occurring and if there is a way to circumvent this?  

Keep in mind, all of these sub-domains are resolving to the same public IPs.  

Regards,

Simon

0 Kudos
2 Replies
PhoneBoy
Admin
Admin

FQDN Objects are working as expected here.
To properly differentiate between hosts on the same IP, you'll need Application Control and HTTPS Inspection.

0 Kudos
Lesley
Leader Leader
Leader

I assume it is running on HTTPS? Doing any HTTPS inspection? Or you do the 'light' version (only checking certificates).

With light you can only see the name of the certificate. This could give behavior you describe now. 

-------
If you like this post please give a thumbs up(kudo)! 🙂
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events