Security policy with sources on a CDN or domains with wildcard

TonyP — Tue, 05 Dec 2023 17:40:12 GMT

Hello to all,

I would like to know how smart PAN admins would solve this problem:

suppose you have to allow inbound traffic from a source address that is:

- defined as a FQDN but you know from DNS that it is delivered via a CDN like cloudflare, akamai, etc

- defined as a domain with a wildcard, for example *.letsencrypt.org

I know that:

- I can't use FQDN address object, cause I can't use wildcards, but also cause CDN do use a fast rotate DNS mechanism (with often lots of addresses), and the firewall cache can't copy well that (if I am not wrong a FQDN address can have up to 10 IP addresses associated in the cache)

- I can't use a CUSTOM URL category object, cause URL categories are only supported for web protocols like HTTP, but most of all cause URL category objects can be used only as a destination filter, not a source filter

- Sadly I can't use minemeld anymore

So.. what workaround would you use, given that this must be a quite common problem?

Thanks in advance

TonyP

Re: Security policy with sources on a CDN or domains with wildcard

kiwi — Wed, 06 Dec 2023 10:38:47 GMT

Hi @TonyP ,

I believe you already mentioned all the proposed solutions by PAN:

FAST-DNS Resolution Issues

I can't come up with another workaround at the moment ... maybe someone smarter here can 😉

Other use cases might require a feature request.

Kind regards,

-Kim.

topic Security policy with sources on a CDN or domains with wildcard in General Topics

Security policy with sources on a CDN or domains with wildcard

Re: Security policy with sources on a CDN or domains with wildcard