Newly Registered Domain Access

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Newly Registered Domain Access

L4 Transporter

Hi All,

We have a request from customer to get access to a newly registered site. After we allowed access to the URL, we see the drop logs due to Sinkhole configuration. Threat Type says Spyware and DNS Policy is configured for newly registered domains as Sinkhole by Default. So this is expected.

But is there any other way i can allow access to this newly registered site without changing the DNS policy? As it will take around 30days for PA to update the URLs is what i read somewhere.

Any suggestions on this please?

Regards,

Sanjay S

3 REPLIES 3

Cyber Elite
Cyber Elite

@Sanjay_Ramaiah,

You have two options for this one:

 

1. Create a DNS Exception entry for the domain under the associated anti-spyware profile that the user's traffic is hitting. This will allow them to access that particular domain, but it does require a commit on the firewall.

 

2. In the event that you start running into this more regularly, you could create a external dynamic list or URLs and use that in an override policy to allow users to a subset of domains. The benefit of this is that you won't need to commit to make changes. 

L4 Transporter

@BPry Thank you for the response.

May be a silly question. I understood EDL but may i know what this "use that in an override policy to allow users to a subset of domains" mean?

Cyber Elite
Cyber Elite

@Sanjay_Ramaiah,

You can use the EDL either in your security rulebase or your url-filtering profiles to quickly allow users access to identified domains that they may need access to. The benefit of using an EDL is that it dynamically updates, so you don't have to worry about needing to do a commit on the firewall for the exception to take effect.

 

As an example I have a security entry that uses a "Bypass-Restrictions" category as match criteria, and that "Bypass-Restrictions" is just the EDL. Then in that security entry I have a url-filtering profile that simply alerts on all categories. This allows anyone access to that rule and any domain in that rule to be accessible.

The primary benefit is that I can dynamically add domains to this list without needing to actually commit any changes on the firewall due to the EDL driving the domains. This also allows me to give certain individuals access to manage the EDL without giving them any access to the firewall itself. 

  • 1101 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!