topic DNS setup best practice in General Topics

DNS setup best practice

deepak12 — Sat, 18 Jul 2020 10:00:24 GMT

Hi All ,

I am planning to use FQDN based address for security policy . Any

best practice to follow . As we have concern related to FQDN dns cache on firewall . And if we are connecting to cloud ( using hybrid setup) any specific recommendation for that as well .

Thanks

Re: DNS setup best practice

deepak12 — Sat, 18 Jul 2020 15:17:50 GMT

@BPry

HI ,

Could you please give any suggestion here .

Thanks ..

Re: DNS setup best practice

SutareMayur — Wed, 22 Jul 2020 14:45:17 GMT

@deepak12,

There are no as such best practice to follow. The only thing you need to consider is DNS configuration on the firewall. As when FQDN based object is configured on firewall, the MGMT plane sends DNS query requests to the configured DNS servers and populates all the IP addresses associated with configured FQDN object. These IP addresses are then forwarded to dataplane and act according to the security policy actions.

Here for Dataplane, this object only acts as a IP address but not as FQDN/domain. There is limit of max 10 IP addresses which are mapped by firewall to one FQDN object. There's no way to modify this limit. In this type of object, you cant configure wildcard domain. For wildcard domains, custom URL category it the option.

Hope it helps!

Mayur

Re: DNS setup best practice

deepak12 — Wed, 22 Jul 2020 14:52:25 GMT

@SutareMayur ,

Hi Mayur ,

Thanks for your help. My concern was mainly due to FQDN cache on firewalls.

I have one more question.supoose we have fqdn along with Uri path like https://abc.company.com/check/folder..

For this case just using fqdn based address will work or need to go for custom url for this as well.

Thanks..

Re: DNS setup best practice

SutareMayur — Thu, 23 Jul 2020 06:36:10 GMT

@deepak12It will work.

For data plane request for https://abc.company.com/check/folder.. will get as https://<FQDN-IP-Address>/check/folder..

You only need to add object without https:// and any URI.

Mayur

Re: DNS setup best practice

deepak12 — Thu, 23 Jul 2020 14:23:36 GMT

Hi @SutareMayur

Thanks for your help ...

Re: DNS setup best practice

OtakarKlier — Thu, 07 Dec 2023 20:35:07 GMT

Hello All,

Also use a secure DNS provider as an added layer. https://www.youtube.com/watch?v=ROIAYSEbTuo

Regards,