Blocking a resource by domain name

[Nadezhda]

Hello Team!

There is a need to block traffic from and to a resource by domain name.
We have created an access control rule with the FQDN object
The problem is that the resource is resolved to many ip addresses, and while Check Point sends a DNS query, half of the traffic is partially missed.

There is an option to increase TTL  as described here https://support.checkpoint.com/results/sk/sk181215, but how effective will it be ?

Are there any other ways to completely deny traffic from a certain domain name and preferably with not too high load on the gateway ?

Also, we are interested in blocking by file resolution using blade ips, but I'm afraid that would be very resource intensive.

[G_W_Albrecht]

sk90401: How are Domain Objects enforced by the Security Gateway?

sk181215: FQDN domain object cannot be matched

[PhoneBoy]

The gateway must either see the DNS requests made by the client (Passive DNS Learning in R80.40+) OR use the same DNS servers the client does.
Otherwise, there will be differences in enforcement, as you are observing.

What do you mean by "blocking by file resolution using IPS" exactly?

[the_rock]

There were few posts about this in the past and this is not sadly the optimal way of doing it. Should be done with urlf blade, as well as when https inspection is enabled. You can create domain object and use it in the rule, but in my experience, that may work randomly, as the fqdn itself may end up resolving to different IPs and they may change constantly.

Best regards,

Andy