topic Re: Allow listing Dynamic IP sites in General Topics

Allow listing Dynamic IP sites

AWaring — Thu, 02 Sep 2021 07:49:28 GMT

Hi All,

We have an issue where we allow list a domain using a dynamic IP, but the host calling the domain and the firewall resolve to different addresses and the connection is drops (in most cases).

We have looked at URL categories but seem to face the same issue.

Can anyone suggest a solution?

Re: Allow listing Dynamic IP sites

PavelK — Fri, 03 Sep 2021 23:25:42 GMT

Thank you for posting question @AWaring would it be possible to get an example of one of the domain?

Kind Regards

Pavel

Re: Allow listing Dynamic IP sites

BPry — Sat, 04 Sep 2021 03:49:01 GMT

@AWaring,

If you use a custom URL category to allow access to the domain and configure the entries properly you don't have to restrict the destination address. If you can give us a bit more information on how you have configured the security policy allowing access to the URL category we can help you get it configured correctly.

The following questions are only relevant if you are attempting to do this through an FQDN object. Again, if you are doing this with a URL category I wouldn't bother limiting it to destination addresses.

How often do you have the firewall set to refresh FQDNs? What do you have the minimum refresh rate set to?
What version of PAN-OS are you running? Newer versions refresh based off of the records TTL.
Are the clients and the firewall setup to use the same DNS providers?