Create a Post
Showing results for 
Search instead for 
Did you mean: 

Domain-Object matching (exact) procedure

Dear CP,

according to your sk120633 (Domain-Objects) the Non-FQDN mode "... uses DNS reverse lookup (if the IP address is not already in cache)."

There is a example where you state that a Non-FQDN-object with

  • ""

would also match

  • "" or
  • ""

(as stated by reverse-looking up the IP)

Therefor I resolved both (using dig):

  • -> ->
  • -> ->

So the client will, for example resolve the domains and get the above IP's.

The package arriving at the Firewall with the "" FQDN-object will now try to resolve these IP's, therefor:

  • -> NX
  • -> plenty

Did I understand the procedure/technic correct? If yes, how should the FW be able to determine that these IP's are belonging to "" if it is either a NX-entry or plenty completely different entries?

Thanks for your help and best regards


0 Kudos
5 Replies
This widget could not be displayed.