DNS setup best practice

[deepak12]

Hi All ,

I am planning to use FQDN based address for security policy  . Any 

best practice to follow . As we have concern related to FQDN dns cache on firewall . And if we are connecting to cloud ( using hybrid setup)  any specific recommendation for that as well .

Thanks 

[deepak12]

@BPry   

HI  ,

Could you please give any suggestion here .

Thanks ..

[SutareMayur]

@deepak12,

There are no as such best practice to follow. The only thing you need to consider is DNS configuration on the firewall. As when FQDN based object is configured on firewall, the MGMT plane sends DNS query requests to the configured DNS servers and populates all the IP addresses associated with configured FQDN object. These IP addresses are then forwarded to dataplane and act according to the security policy actions.

Here for Dataplane, this object only acts as a IP address but not as FQDN/domain. There is limit of max 10 IP addresses which are mapped by firewall to one FQDN object. There's no way to modify this limit. In this type of object, you cant configure wildcard domain. For wildcard domains, custom URL category it the option.

Hope it helps!

Mayur

[deepak12]

@SutareMayur ,

Hi Mayur ,

Thanks for your help. My concern was mainly due to FQDN cache on firewalls. 

I have one more question.supoose we have fqdn along with Uri path like https://abc.company.com/check/folder..

For this case just using fqdn based address will work or need to go for custom url for this as well.

Thanks..

[SutareMayur · Accepted solution]

@deepak12It will work.

For data plane request for https://abc.company.com/check/folder.. will get as https://<FQDN-IP-Address>/check/folder..

You only need to add object without https:// and any URI.

Mayur

[deepak12]

Hi @SutareMayur 

Thanks for your help ...

[OtakarKlier]

Hello All,

Also use a secure DNS provider as an added layer. https://www.youtube.com/watch?v=ROIAYSEbTuo

Regards,

Regards,