r80.10 FQDN allow rule not being picked up in DMZ zone.

[Mike_Lutgendorf]

TL;DR

Have rules for cylance.com being allowed on the application layer (All traffic regardless of zones.) However, the DMZ network is not seeing all their AWS instances as "cylance.com"

Okay fine I'll create a network rule (Seeing its traffic get blocked by last catch-all block/drop) for the DMZ to wildcard *.cylance.com <--- But you can't do that so I did .*\.cylance.com (FQDN domain object.)

Still nada. The odd thing is DMZ stuff isn't resolving their AWS addresses as standard traffic does.

Does anyone know where I've gone wrong?

Thanks in advance.

[PhoneBoy]

You can’t do wildcards with FQDN objects.
A specific hostname must be used.
The fact the GUI allows what you specified could be viewed as a bug.

[Mike_Lutgendorf]

Gotcha so I shouldn't be using the FQDN? 

If I use a host it will resolve to one IP which for a smattering of AWS addresses doesn't help solve the issue. (Recommended by the vendor instead of saying them just providing a block)

Which is still a question to why the addresses don't resolve for certain zones, to begin with.

[Dima_M · Accepted solution]

Domain object has FQDN and non FQDN modes. Non FQDN mode enforces the domain and its sub-domains (Gateway performs reverse DNS lookup).

".cylance.com" in non FQDN mode should work for you.

[PhoneBoy]

However, that assumes the reverse DNS of the relevant IPs resolves to something.cylance.com.
This has never been a fantastic assumption.