topic Re: FQDN based PBF in General Topics

FQDN based PBF

tmyzw — Mon, 22 Jul 2019 04:59:28 GMT

Hello,

I have a customer who wants to replace proxy servers to NGFW.

The proxy server is used for website filtering as well as URL based routing especially for G Suite.

Unfortunately, PBF policy rule doesn't have URL as match criteria and only FQDN object can be used for that purpose.

But google publishes some wildcard or single digit number URLs as URL list used by G Suite(and Goodle Drive).

ex.

*.drive.google.com

*.clients[N].google.com

What I want to do is to accomplish URL based (or similar) PBF without proxy server including above URLs.

https://support.google.com/a/answer/2589954

Thanks,

Takahiro

Re: FQDN based PBF

reaper — Tue, 23 Jul 2019 13:53:39 GMT

A firewall is not a proxy server, so functionality is different. What is the use case for only a handful of URLs to be rerouted? there could be a different solution by applying firewall logic to a network issue (rather than proxy logic) PBF is tcp/udp oriented routing feature, so it functions best at layer3 and below.

Re: FQDN based PBF

tmyzw — Wed, 24 Jul 2019 20:08:57 GMT

Hello,

Thank you for your reply.

The customer currently has two internet links, one is for G Suite and the other is for the rest. And a proxy server sits on the latter link. So their PAC file has statement kind of like "direct connect for G Suite URLs and via proxy for the rest".

What I want the customer do is to ditch the proxy server for maximum budget allocation to us.

To accomplish this, two internet links are connected to our NGFW and select link based on destination URL which is eventually IP address.

We only can use FQDN object for that purpose but FQDN object doesn't support wildcard FQDN as well as FQDN includes an arbitrary number.

This is why I'm looking for a way to accomplish this.

Thanks,

Takahiro