- CheckMates
- :
- Products
- :
- Quantum
- :
- Security Gateways
- :
- Re: Domain object FQDN not matching properly
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Domain object FQDN not matching properly
Hi dears,
R81.10 JHT 109
A month ago I was testing Reverse Proxy usage. And it worked great with Access Policy.
My test Reverse Proxy rules were like this:
rule1 | https://test1.domain.example/ -> http://192.168.10.10/
rule2 | https://test2.domain.example/ -> http://192.168.20.20/
Test Security Access Rules were:
AccRule1
Source: ExternalIP1
Dst: .test1.domain.example (Domain Object FQDN)
Service: HTTPS
Action: Accept
AccRule2
Source: ExternalIP2
Dst: .test2.domain.example (Domain Object FQDN)
Service: HTTPS
Action: Accept
And it worked fine that time! ExternalIP1 was accessing .test1.domain.example and couldnt access to .test2.domain.example. All other external requests to my domain were dropping by cleanup rule.
But now Firewall stopped matching FQDNs. When ExternalIP1 is connecting to .test2.domain.example it passess traffic via AccRule1 and according to Logs destination shown as .test1.domain.example. It is not resolving FQDN.
Any suggestions?
Thanks in advance.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you done any troubleshooting with the domains tool?
See: https://support.checkpoint.com/results/sk/sk161632
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Domain Object is resolving fine.
domains_tool -report - gave just Undefined DNS servers found.
The issue is that Firewall blade matching FQDN of second.domain.example as first.domain.example. It sees not as second.domain but as first.domain.example - in Logs. First Access Rule contains first.domain.example. And even if there is no access rule for the second.domain.example but Reverse Proxy rule exists, request to second domain passess Firewall as Dst:first.domain.example and then goes to RProxy rule)
So I am a bit confused. It was working fine while testing. But now it just wont.
Look at the screenshot:
Access rule has only one service (8001) that's hidden behind RProxy and first FQDN but it forwards it to two services (8001 and 8003) because the second FQDN recognized as first and passed to PRoxy rule for 8003 service.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When you say Reverse Proxy, you mean this functionality?
https://support.checkpoint.com/results/sk/sk110348
Regardless, you’ll probably need to consult with the TAC on this: https://help.checkpoint.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I've opened ticket, thanks.
Maybe it is a bug.
I will share if CP team will give me the solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@nemezis_rock this looks like a follow up of your formerly post https://community.checkpoint.com/t5/Security-Gateways/Implied-Rules-accepting-HTTP-HTTPS-traffic-How... Please have a look at my last comment.
Does test2.domain.example and test1.domain.example resolve via DNS to the same IP address ? (Should be, because you want to forward these via Reverseproxy)
If yes, you see expected behaviour, because the gateways handles the rule with an domain-object with the DNS resolved IP address and not the FQDN or URL.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The point is that it was working fine while testing.
Firewall blade saw two FQDNs perfectly. I've created two domain objects pointed to the same GW-Extrernal address.
I found Logs especially for you)
Two separate external sources - .199 and .66. Look on the Access Rule number. One source goes through rule 5 and another through rule 4.
And here are logs which shows that fqdns is matching perfectly. Firewall blade sees every FQDN:
Now you see that Firewall Blade saw every FQDN (test123 and asdasd) perfectly even if they were pointed to the same IP .30.
That is my problem. Firewall Blade forgot how to do it)
By your logic, logs must show only one fqdn, and acces only via one rule. That is happening now. But back then... So i think we have to remind Firewall how to do it.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I read all your responses and they all seem 100% logical to me. Let us know what TAC says.
Andy
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@nemezis_rock I think the different log entries are an result of the name resolution in SmartDashboard or/and logserver.
But again, if both FQDNs points to the same IP address I'm pretty sure you can't achieve this way what you want.
