Finding FQDNs for blocked IP's or SSL-Inspection

ppeeters — Fri, 10 Jan 2025 15:36:25 GMT

Once a week, someone reports having issues accessing a site. Today that issue involves a credit card processing page that is aging-out because there is no SSL inspection exception. FW Logs of course show an IP address (no URL/FQDN), and the rule to allow access or exclude from ssl inspection requires using an FQDN.

The page URL in address bar has been allowed and browser/dev tools/console/sources does not indicate any other place where the browser is trying to go. I also look at OpenDNS reports to see what DNS queries the user made around the same time. There can be 100 sites within a few seconds, so I end up doing an NSLOOKUP on each of the FQDNs in the OpenDNS report to see if the IP matches the blocked traffic in the FW. Once I match the FQDN to the IP, I know that is the FQDN that needs to be unblocked in the FW.

This is a very tedious process, and after spending an hour on this today, I am not able to find the right FQDN to match the IP's that are being blocked.

Does anyone have a tool or better way to locate FQDNs for blocked IP's? If life were easy, OpenDNS (OR PALO) would record both the FQDN and the translated IP when DNS is queried so I would not have to search for it, but alas, that doesn't seem to be a thing for any vendor, so I keep having to do these treasure hunts on a regular basis.

Any suggestions/tricks/tips would be greatly appreciated.

Re: Finding FQDNs for blocked IP's or SSL-Inspection

ozheng — Tue, 14 Jan 2025 02:31:46 GMT

Hello @ppeeters ,

DNS Security may help, if your FQDN is somehow a possible risk domain.

Maybe you can enable the logging (once your firewall is fixed for CVE-20243393) and monitor the threat logs for input.

Otherwise, you can let a capture running on DNS traffic from a computer and check directly in the capture when needed.

Similar to that, you can set up a DNS proxy on the firewall, so you can check on the DNS proxy cache on the firewall.

Olivier

topic Finding FQDNs for blocked IP's or SSL-Inspection in Next-Generation Firewall Discussions

Finding FQDNs for blocked IP's or SSL-Inspection

Re: Finding FQDNs for blocked IP's or SSL-Inspection