I have a few different clients with the same issue.
I have some FQDN address objects and I assign a TAG to each of those objects. Then I create a Dynamic address object group which contains address objects with that tag. Then I add the dynamic group to a policy.
Traffic is not matching on that policy; it is matching on explicit deny rule.
If I run "request system fqdn show", I get:
sharepoint.domain.org (Objectname SharePoint):
From the PAN, I can surely resolve the specific names. It just isn't storing them in the object db it appears. If I change the address object group to a static group and add the address objects manually as opposed to tagging/dynamic, it works fine.
The above mentioned symptoms is looks like Bug - "FQDN objects in Dynamic address group show up as not used when doing 'request system fqdn show".
Few related discussion on the same topic:
Hope this helps.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!