topic Will FQDN names work when the name resolves to a content delivery service? in General Topics

Will FQDN names work when the name resolves to a content delivery service?

jraleigh — Tue, 04 Sep 2012 14:38:27 GMT

For example:

H:\>dig www.microsoft.com

; <<>> DiG 9.2.3 <<>> www.microsoft.com

;; global options: printcmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41

;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:

;www.microsoft.com. IN A

;; ANSWER SECTION:

www.microsoft.com. 1937 IN CNAME toggle.www.ms.akadns.net.

toggle.www.ms.akadns.net. 20 IN CNAME g.www.ms.akadns.net.

g.www.ms.akadns.net. 20 IN CNAME lb1.www.ms.akadns.net.

lb1.www.ms.akadns.net. 265 IN A 65.55.57.27

If you were allowing access to www.microsoft.com, wouldn't everything that these akands.net devices being allowed?

Re: Will FQDN names work when the name resolves to a content delivery service?

mikand — Tue, 04 Sep 2012 16:38:37 GMT

I dont know how roundrobin dns names are handled in the PA.

But regarding address objects containing FQDN instead of IP the FQDN is resolved during commit and then there is a script that every 20 (or if it was 30) minutes will recommit the FQDN portions to keep them up2date (because in the fabric only ip addresses are being handled).

In you case (if possible) you could add an url filter aswell if you only want to allow requests towards www.microsoft.com.

Re: Will FQDN names work when the name resolves to a content delivery service?

jraleigh — Fri, 07 Sep 2012 15:34:35 GMT

Well, my problem is that we are using authenticated access... Certain users groups have rights to access more URL groups than others...

How would I create a URL filter to allow un-authenticated access to www.microsoft.com while continuing to require authenticated access for the other type of URL groups?

Any help on this would be greatly appreciated!!

Re: Will FQDN names work when the name resolves to a content delivery service?

ExclusiveNetworksGermany — Fri, 07 Sep 2012 15:46:38 GMT

Well you can use a security Policy before all others

with a Custom URL Category as match Object and allow traffic through this Rule (supported since 4.1.x)

Like this:

Kind regards

Marco

Re: Will FQDN names work when the name resolves to a content delivery service?

jraleigh — Thu, 13 Sep 2012 16:44:47 GMT

That would be great if we were running 4.1... We're still on 4.0.12 at this point... With 17 firewalls and Panorama, upgrading is somewhat painful..

Re: Will FQDN names work when the name resolves to a content delivery service?

mharding — Thu, 13 Sep 2012 20:47:46 GMT

Panorama should make that easy.