Help whitelisting a URL that routes through Cloudfront

[BenOesterling]

Hi all, I am having trouble whitelisting a site and wanted to see what I can do about it.  The website I am whitelisting is https://www.pahealthwellness.com/login.html.  When you make some selections on the page, it redirects to https://sso.entrykeyid.com . I have a rule set to allow both those URL's with wildcards, but the bigger problem is that the traffic is hitting cloudfront and getting blocked based on that.  I dont want to whitelist all of cloudfront, but I cant figure out a way around this.  I can give more detail if needed, I just want to see if I am missing something basic here.

[EricHaug]

I have a similar problem and I can't even get things to work after whitelisting *.cloudfront.net.  It's as if the laptop's DNS is resolving to an IP address different than the Palo Alto.  I have the Minimum FQDN refresh time set to zero in Device > Setup > Services but it still won't match the policy.

[Adrian_Jensen]

It sounds (and after a quick check of pahealthwellness.com confirmed) that website is using fast-flux DNS. The DNS resolution is constantly changing over a range of IPs, so the firewall and client DNS responses will diverge, and hence the firewall doesn't know the IP the client browser is currently connecting to is actually the same as the FQDN in the firewall. There are really only 2 options if you want to whitelist this server and block other traffic. See my previous thread here:

https://live.paloaltonetworks.com/t5/panorama-discussions/frequently-changing-ip-for-a-fqdn/td-p/547...

https://www.paloaltonetworks.com/cyberpedia/what-is-a-fast-flux-network

Note: The PA minimum FQDN refresh time will never drop below 30sec (regardless of the config setting) as that is hardcoded to prevent the firewall from thrashing on invalid/extremely short TTL FQDNs.