topic Re: Newly Registered Domain Access in General Topics

Newly Registered Domain Access

Sanjay_Ramaiah — Tue, 10 Oct 2023 11:34:12 GMT

Hi All,

We have a request from customer to get access to a newly registered site. After we allowed access to the URL, we see the drop logs due to Sinkhole configuration. Threat Type says Spyware and DNS Policy is configured for newly registered domains as Sinkhole by Default. So this is expected.

But is there any other way i can allow access to this newly registered site without changing the DNS policy? As it will take around 30days for PA to update the URLs is what i read somewhere.

Any suggestions on this please?

Regards,

Sanjay S

Re: Newly Registered Domain Access

BPry — Tue, 10 Oct 2023 13:15:17 GMT

@Sanjay_Ramaiah,

You have two options for this one:

1. Create a DNS Exception entry for the domain under the associated anti-spyware profile that the user's traffic is hitting. This will allow them to access that particular domain, but it does require a commit on the firewall.

2. In the event that you start running into this more regularly, you could create a external dynamic list or URLs and use that in an override policy to allow users to a subset of domains. The benefit of this is that you won't need to commit to make changes.

Re: Newly Registered Domain Access

Sanjay_Ramaiah — Thu, 12 Oct 2023 05:11:14 GMT

@BPry Thank you for the response.

May be a silly question. I understood EDL but may i know what this "use that in an override policy to allow users to a subset of domains" mean?

Re: Newly Registered Domain Access

BPry — Thu, 12 Oct 2023 13:10:09 GMT

@Sanjay_Ramaiah,

You can use the EDL either in your security rulebase or your url-filtering profiles to quickly allow users access to identified domains that they may need access to. The benefit of using an EDL is that it dynamically updates, so you don't have to worry about needing to do a commit on the firewall for the exception to take effect.

As an example I have a security entry that uses a "Bypass-Restrictions" category as match criteria, and that "Bypass-Restrictions" is just the EDL. Then in that security entry I have a url-filtering profile that simply alerts on all categories. This allows anyone access to that rule and any domain in that rule to be accessible.

The primary benefit is that I can dynamically add domains to this list without needing to actually commit any changes on the firewall due to the EDL driving the domains. This also allows me to give certain individuals access to manage the EDL without giving them any access to the firewall itself.