How to Configure and Test FQDN Objects
383359
Created On 09/25/18 17:39 PM - Last Modified 01/12/22 21:24 PM
Environment
- PAN-OS 7.1 and higher.
- Palo Alto Firewall.
- Address Object Configuration.
Resolution
Considerations
- The FQDN object is an address object, which means it's as good as referencing a Source Address or Destination Address in a security policy.
- Therefore, every 30 minutes, the Palo Alto Networks Firewall will do an FQDN Refresh, in which it does an NS lookup to the DNS server that's configured (Setup > Services). The firewall maps up to 32 IP addresses to that FQDN object.
- Make sure that this is the same server that your hosts are using. DNS malware can adversely affect a solution like this.
- Use this method only when using an IP address is not possible--don't use this type of object as part of a URL filtering policy.
- This can also be helpful to control other services that don’t relate to web browsing like ftp, ssh, or any other service.
- If the object also resolves to an IPv6 address, enable IPv6 Firewalling (Device > Setup > Session).
Configuring the object
To begin configuration of FQDN objects, go to Objects > Addresses
- Click Add to create a new address object
- Change the type from ‘IP/Netmask’ to ‘FQDN’
- Enter the address (do not include http:// or any other header)
- Click OK
- Commit the changes
On the CLI, FQDN objects can be set using the following command in configure mode:
# set address Google fqdn www.google.com
Confirming the changes
- An automatic Refresh FQDN task will run in the background. The status of this job can be checked by clicking the Tasks button at the bottom right corner of the GUI.
- The CLI command below can then be used to view the list of FQDN objects and the IP addresses associated with that name.
- PAN-OS 8.1 and below: > request system fqdn show
- PAN-OS 9.1 and above: > show dns-proxy fqdn all
- It is possible to force a refresh by running the command above.
- As a recommended extra check, ping the host from a desktop to make sure it matches the IP address listed after running the command.