topic Re: Is it possible to disable FQDN refresh? in General Topics

Is it possible to disable FQDN refresh?

Craig_Bowser — Wed, 19 Jun 2019 11:49:04 GMT

According to these articles:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHJCA0

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClKbCAK

it is possible to change the timing of how often PA does a refresh for FQDN objects, but is there a way to disable the refresh, either globally or for specific objects?

Thanks

Re: Is it possible to disable FQDN refresh?

reaper — Wed, 19 Jun 2019 11:52:58 GMT

Why would you want to do this? if there's no need for refresh, you can simply create a static entry and use the fqdn as name

Re: Is it possible to disable FQDN refresh?

Craig_Bowser — Wed, 19 Jun 2019 11:59:31 GMT

The reason for this question is due to an animated (but not hostile) discussion about this behavior and dns blacklist alerts. We had already shifted to a different method of blocking the FQDN in question, but just wanted some resolution of this question.

Thanks.

Re: Is it possible to disable FQDN refresh?

BPry — Thu, 20 Jun 2019 16:57:21 GMT

@Craig_Bowser,

The fqdn refresh timmer is a system wide setting and isn't something that you can modify a setting to disable, as the whole point of utilizing FQDN is to be able to refresh the object.

Re: Is it possible to disable FQDN refresh?

Craig_Bowser — Thu, 20 Jun 2019 17:18:08 GMT

Thanks!