question of FQDN based security policy and country ip db update cycle

willstech — Sun, 13 Nov 2011 21:26:50 GMT

Hello there.

I have couple of question below.

1. add new security policy based on FQDN

i have two DNS records on the same machine and same IP address like below.

1. groupware. aaa.com (IP: 192.168.1.10, tcp port 6363)

2. www.aaa.com (IP: 192.168.1.10, tcp port 80)

Customer wants to add a security policy by FQDN for blocking for groupware.aaa.com like security policy below.

Security policy:

src.ip external src.port any dst.ip groupware.aaa.com dst.port any tcp port 6363 application any action: block

External users can access www.aaa.com, but should block if external users try to access a groupware.aaa.com by FQDN security policy.

is it possible to apply as my expectation?

2. country ip db update cycle.

PAN can block based on country IP and PAN also has a DB of country IP list.

As I known palo alto networks gets DB of country IP list from arin.(www.arin.net)

1. How often have a updates between ARIN and Palo alto networks ? real time?? Or 2 times a day? Every hours??

2. How often has a update between palo alto netowkr and end user of PAN device? real time?? Or 2 times a day? Every single hour?? question of country IP DB update interval.

Please let me know my questions.

Thanks.

Re: question of FQDN based security policy and country ip db update cycle

dburns — Wed, 16 Nov 2011 01:24:57 GMT

1. Yes it can work this way. The IP address is the same so if the allow rule above is set to allow port 80 but the deny rule is set to block port 6363, this should work. If you had both request going to port 80, block it with a url filtering policy.

2. The Countries db is updated to the firewall via app package. This is released once a week (usually Tuesday night GMT-8)

Dominic

topic question of FQDN based security policy and country ip db update cycle in General Topics

question of FQDN based security policy and country ip db update cycle

Re: question of FQDN based security policy and country ip db update cycle