topic Re: Using ftd to block subdomains on the internet. in Network Security

Using ftd to block subdomains on the internet.

tryingtofixit — Fri, 07 Mar 2025 17:50:51 GMT

I need to lock javada1.oracle.com, javadl-esd-secure.oracle.com, java.com and java.net.

Can I do this using a FQDN object and a deny access rule? What is the process for blocking subdomains with the ftd?

Re: Using ftd to block subdomains on the internet.

nspasov — Fri, 07 Mar 2025 18:51:56 GMT

Yes, you can use FQDN objects to do this. You will need an object for each FQDN that you want to block: https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/770/management-center-device-config-77/objects-object-mgmt.html?bookSearch=true

You can use FQDN objects in access control rules and prefilter rules, or manual NAT rules, only. 
The rules match the IP address obtained for the FQDN through a DNS lookup. 
To use an FQDN network object, ensure you have configured the DNS server settings in DNS Server Group
and the DNS platform settings in DNS.

Thank you for rating helpful posts!

Re: Using ftd to block subdomains on the internet.

tryingtofixit — Fri, 07 Mar 2025 20:12:54 GMT

thanks for the link. I have it configured as a fqdn object in block access rule. dns is enabled and working on the fmc to the ftd. nothing gets blocked. got any troubleshooting links ?

Re: Using ftd to block subdomains on the internet.

tryingtofixit — Fri, 07 Mar 2025 22:05:35 GMT

how can I tell fmc/ftd DNS resolution is working? It is configured on FMC. but DNS is NOT resolving for FQDN's or URL's. I can ssh into the cli on the ftd and ping internal and external by name.

Re: Using ftd to block subdomains on the internet.

nspasov — Fri, 07 Mar 2025 23:10:36 GMT

Can you confirm the following:

You have DNS objects configured: Object -> Object Management -> DNS Server Group
DNS is configured on FTD: Devices -> Platform Settings -> DNS:
1. Enable DNS name resolution by device
2. DNS Server Groups contains the DNS object from above
3. The correct interface objects are selected for DNS resolution
Post the output from the following commands in the FTD cli: system support diagnostic-cli -> enable:
1. show run dns
2. ping www.cisco.com
3. Extended ping: ping -> TCP Ping [n] -> Interface [Desired interface] -> Target IP address [www.google.com] > Repeat count [5] -> Datagram size [100] -> Timeout in seconds [2] -> Extended commands [n] -> Sweep range of size [n]

Thank you for rating helpful posts!