question of FQDN based security policy and country ip db update cycle

[willstech]

Hello there.

I have couple of question below.

1. add new security policy based on FQDN

    i have two DNS records on the same machine and same IP address like below.

      1. groupware. aaa.com (IP: 192.168.1.10,  tcp port 6363)

      2. www.aaa.com (IP: 192.168.1.10,  tcp port 80)

   Customer wants to add a security policy by FQDN for blocking for groupware.aaa.com like security policy below.

   Security policy:

   src.ip external src.port any  dst.ip groupware.aaa.com dst.port  any   tcp port 6363   application any  action: block

   External users can access www.aaa.com, but should block if external users try to access a groupware.aaa.com by FQDN security policy.

   is it possible to apply as my expectation?

2. country ip db update cycle.

    PAN can block based on country IP and PAN also has a DB of country IP list.

    As I known palo alto networks gets DB of country IP list from arin.(www.arin.net)

      1. How often have a updates between ARIN and Palo alto networks ? real time?? Or 2 times a day? Every hours??

      2. How often has a update between palo alto netowkr and end user of PAN device? real time?? Or 2 times a day? Every single hour?? question of country IP DB update interval.

Please let me know my questions.

Thanks.

[dburns · Accepted solution]

1. Yes it can work this way. The IP address is the same so if the allow rule above is set to allow port 80 but the deny rule is set to block port 6363, this should work. If you had both request going to port 80, block it with a url filtering policy.

2. The Countries db is updated to the firewall via app package. This is released once a week (usually Tuesday night GMT-8)

Dominic