Address object Best Practices FQDN or IP Address

[AWAITKUS]

Is there any down side to referencing your address objects using FQDN? Does it add significant load to the PA?

[HULK]

Hello x2apwait,

As per my understanding, it would not make any load to the PAN FW. The PAN firewall will automatically refresh the FQDN table every 15 minutes. The same job can be monitor    through CLI command >show jobs all.

Thanks

[mivaldi]

+1 on HULK's info. I wanted to add that, It depends on the FQDN.

Don't use FQDN's for large corporations, where they either use CDN's or round robin DNS. Because the frequency is a 15 minute refresh, there's no real time DNS resolution for FQDN's. This may lead to incorrect or unexpected behaviors.

There's also another practice, that is, to give you a long list of possible IP's on a single A record. The firewall will only grab the first ten provided on that long list.