topic Help whitelisting a URL that routes through Cloudfront in General Topics

Help whitelisting a URL that routes through Cloudfront

BenOesterling — Fri, 19 Apr 2024 20:23:35 GMT

Hi all, I am having trouble whitelisting a site and wanted to see what I can do about it. The website I am whitelisting is https://www.pahealthwellness.com/login.html. When you make some selections on the page, it redirects to https://sso.entrykeyid.com . I have a rule set to allow both those URL's with wildcards, but the bigger problem is that the traffic is hitting cloudfront and getting blocked based on that. I dont want to whitelist all of cloudfront, but I cant figure out a way around this. I can give more detail if needed, I just want to see if I am missing something basic here.

Re: Help whitelisting a URL that routes through Cloudfront

EricHaug — Tue, 30 Jul 2024 16:37:15 GMT

I have a similar problem and I can't even get things to work after whitelisting *.cloudfront.net. It's as if the laptop's DNS is resolving to an IP address different than the Palo Alto. I have the Minimum FQDN refresh time set to zero in Device > Setup > Services but it still won't match the policy.

Re: Help whitelisting a URL that routes through Cloudfront

Adrian_Jensen — Tue, 30 Jul 2024 21:10:07 GMT

It sounds (and after a quick check of pahealthwellness.com confirmed) that website is using fast-flux DNS. The DNS resolution is constantly changing over a range of IPs, so the firewall and client DNS responses will diverge, and hence the firewall doesn't know the IP the client browser is currently connecting to is actually the same as the FQDN in the firewall. There are really only 2 options if you want to whitelist this server and block other traffic. See my previous thread here:

https://live.paloaltonetworks.com/t5/panorama-discussions/frequently-changing-ip-for-a-fqdn/td-p/547597

https://www.paloaltonetworks.com/cyberpedia/what-is-a-fast-flux-network

Note: The PA minimum FQDN refresh time will never drop below 30sec (regardless of the config setting) as that is hardcoded to prevent the firewall from thrashing on invalid/extremely short TTL FQDNs.