topic Address object Best Practices FQDN or IP Address in General Topics

Address object Best Practices FQDN or IP Address

AWAITKUS — Tue, 10 Feb 2015 17:20:38 GMT

Is there any down side to referencing your address objects using FQDN? Does it add significant load to the PA?

Re: Address object Best Practices FQDN or IP Address

HULK — Tue, 10 Feb 2015 17:28:45 GMT

As per my understanding, it would not make any load to the PAN FW. The PAN firewall will automatically refresh the FQDN table every 15 minutes. The same job can be monitor through CLI command >show jobs all.

Thanks

Re: Address object Best Practices FQDN or IP Address

mivaldi — Tue, 10 Feb 2015 18:54:12 GMT

+1 on HULK's info. I wanted to add that, It depends on the FQDN.

Don't use FQDN's for large corporations, where they either use CDN's or round robin DNS. Because the frequency is a 15 minute refresh, there's no real time DNS resolution for FQDN's. This may lead to incorrect or unexpected behaviors.

There's also another practice, that is, to give you a long list of possible IP's on a single A record. The firewall will only grab the first ten provided on that long list.