If I have a FQDN "abc.com" that have two DNS records 10.0.0.1 and 10.0.0.2. Then I create a address object with FQDN type, and the value is "abc.com" When I use this object into security policy, how does it working? Does it become 10.0.0.1 or 10.0.0.2 ? or it will randomize according to catch? If a client connect to "abc.com", and the client's DNS (Ex. F5 GTM) resolve this FQDN become 10.0.0.1. but in the security policy, the PaloAlto Firewall says "abc.com" is 10.0.0.2. I think that would be a problem because sometimes it can match the rule and sometimes doesn't. My purpose is if I use address object with FQDN then PaloAlto Firewall can resolve all about this FQDN's IP address, and apply to rule dynamically. If the address object with FQDN always just can resolve one IP address, I think It should not be use. doesn't it?
... View more
