Security Policy with URLs

[dstewart65]

Is it possible to create a Security Policy with the Destination address as a URL? I would prefer to use the URL to avoid using the IP in case the destination service changes it.

Thanks,

Dennis

[mharding · Accepted solution]

Yes, create an address object, use the FQDN from the drop down, and enter your URL.

I believe the refresh job runs every 30 minutes to convert that URL to an IP address.

[mikand]

In that case dont forget to add a url-filter aswell for the same FQDN (specially if this is http traffic).

The bad part (security wise) of using FQDN as dstip is that you will rely on what answer the external (compared to the PA itself) dns will bring you.

[dstewart65]

Thanks, creating the address object worked.

[dstewart65]

This is not http traffic, it's secure FTP (as best it can be) on uncommon ports. I will keep the url-filtering underadvisement.

Thanks.