Palo Alto Networks Knowledgebase: How to Configure and Test FQDN Objects

How to Configure and Test FQDN Objects

49204
Created On 08/05/19 19:57 PM - Last Updated 08/05/19 20:11 PM
Policy
Resolution

Considerations

  • The FQDN object is an address object, which means it's as good as referencing a Source Address or Destination Address in a security policy.
  • Therefore, every 30 minutes, the Palo Alto Networks Firewall will do an FQDN Refresh, in which it does an NS lookup to the DNS server that's configured (Setup > Services). The firewall maps up to 10 IP addresses to that FQDN object.
  • Make sure that this is the same server that your hosts are using. DNS malware can adversely affect a solution like this.
  • Use this method only when using an IP address is not possible--don't use this type of object as part of a URL filtering policy.
  • This can also be helpful to control other services that don’t relate to web browsing like ftp, ssh, or any other service.
  • If the object also resolves to an IPv6 address, enable IPv6 Firewalling (Setup > Session).

Configuring the object

To begin configuration of FQDN objects, go to Objects > Addresses

  1. Click Add to create a new address object
  2. Change the type from ‘IP/Netmask’ to ‘FQDN’
  3. Enter the address (do not include http:// or any other header)
  4. Click OK
  5. Commit the changes

2.JPG

On the CLI, FQDN objects can be set using the following command in configure mode:

# set address Google fqdn www.google.com

Confirming the changes

  • An automatic Refresh FQDN task will run in the background. The status of this job can be checked by clicking the Tasks button at the bottom right corner of the GUI.
  • The CLI command request system fqdn show can then be used to view the list of FQDN objects and the IP addresses associated with that name.
  • It is possible to force a refresh by running the command request system fqdn refresh.
  • As a recommended extra check, ping the host from a desktop to make sure it matches the IP address listed after running the command: request system fqdn show.

owner: kgotlob



Attachments
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHJCA0&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Attachments
Choose Language