topic Re: wildcard fqdn for destination in security policy. FQDN for abc*.def.com in General Topics

wildcard fqdn for destination in security policy. FQDN for abc*.def.com

Jorge_Pizarro — Fri, 09 Jul 2021 16:03:47 GMT

Team , I have a question about something that I guess is not possible to configure but will like to confirm if possible . My client want to allow Internal NW 10.0.0.0/8 to FQDN abc1.def.com port HTTPS , this is normal and I have a few of this rules already implemented. Now the question is , is possible to create a FQDN for abc*.def.com?, a wildcard FQDN like abc*.edf.com could be created, it would cover all the individually numbered abc destinations or I will have to create individuals FQDNs for each abc*. . Thanks in advance

Re: wildcard fqdn for destination in security policy. FQDN for abc*.def.com

JoergSchuetter — Fri, 09 Jul 2021 16:37:25 GMT

Hello

If I remember it right, then the asterisk can only be used between dots, between start and dot, and between dot and end.

To achieve what you plan, you need to use ^ (which requires PAN-OS 9.1 or higher) --> abc^.def.com/

Re: wildcard fqdn for destination in security policy. FQDN for abc*.def.com

Jorge_Pizarro — Fri, 09 Jul 2021 17:52:59 GMT

Hi JoergSchuetter

I tested this on 9.1 abc^.def.com , The value on this field is invalid , Cant use ^ on the FQDN. Any other suggestion. Thanks

Re: wildcard fqdn for destination in security policy. FQDN for abc*.def.com

JoergSchuetter — Fri, 09 Jul 2021 18:17:38 GMT

My bad, I thought you were talking about a fqdn within a URL object.

Re: wildcard fqdn for destination in security policy. FQDN for abc*.def.com

Jorge_Pizarro — Fri, 09 Jul 2021 20:40:22 GMT

I was wondering if instead of creating 5 different FQDN objects abc1.def.com, abc2.def.com, abc3.def.com, abc4.def.com, abc5.def.com, I could create one to cover all 5 , abc*.def.com. So far I guess is not possible.

Re: wildcard fqdn for destination in security policy. FQDN for abc*.def.com

Jorge_Pizarro — Mon, 12 Jul 2021 12:06:45 GMT

Thanks