Hello,
I was given a chunk of IP addresses and domains/urls to update into an existing blacklist on the firewall. I go to objects and create ip-netmask for ip addresses and FQDN objects for domains/urls. Some of the domains i received come in the form of url like "xxxxxx.xxx.com/*" and "https://xxxxxxxx.com/xxxx/xxxx.zip " I decided to create an FQDN object for the domain of xxxxxx.xxx.com instead of xxxxxx.xxx.com/* because FQDN does not allow '/'. I did not create custom URL category for the long urls. When i committed and pushed the firewall changes to the device, some of the users who are accessing a work url that is not relevant to the ones i have blacklisted began to experience connectivity issue.
The traffic logs flowing towards 1.1.1.1 and 8.8.8.8 seems to be deny and drop.
After this failure, I created a custom URL category for those urls which i created FQDN object for earlier and attached in the service url category of the firewall blacklist rule. The FQDN object i created for the url to block the domain is still present. The traffic towards the 1.1.1.1 and 8.8.8.8 seems to be resolved and the users are able to access their work-related url.
I then removed the FQDN objects that i created to for the url, and the traffic is working. I
I removed both the FQDN object for the url and the custom url category, the DNS deny policy shows up again.
When i added the custom url category back onto the firewall rule, the DNS is resolved.
May i know if anyone here has experienced similar issues and know what has happened that caused this.
Is is because the DNS server could not resolve the FQDN object and results in this deny policy towards the DNS?
Thanks
