topic FTD/FMC DNS Group objects? in Network Security

FTD/FMC DNS Group objects?

Warren Sullivan - Corp — Fri, 21 Feb 2020 17:17:55 GMT

Hi Guys,

We are migrating from SOPHOS UTM to FTD/FMC and i'm in my documentation stage.

SOPHOS has an object called a "DNS Group" object, this can be used anywhere in the firewall, essentially this object will query and store all IPs for the destination in the variable, and keep it updated, see below;

As you can see, the object "s3-ap-southeast-2.amazonaws.com" has picked up 106 IP Addresses, and i use this object in a firewall rule to allow traffic to this destination.....

Can this be done with FTD/FMC?

If so, great! how would i find out what IPs have been resolved?

If not.....what could i do as a work around, beside inputting 106 IP Addresses into a group...

Re: FTD/FMC DNS Group objects?

Marvin Rhoads — Thu, 11 Jul 2019 12:35:52 GMT

If it's used in an ACL, you can simply use the FQDN directly.

Re: FTD/FMC DNS Group objects?

Warren Sullivan - Corp — Thu, 11 Jul 2019 22:51:26 GMT

So it will pickup all 106 IP Addresses?

Re: FTD/FMC DNS Group objects?

Marvin Rhoads — Fri, 12 Jul 2019 04:57:23 GMT

More or less - it will evaluate traffic as to whether it matches any of the addresses that resolve from that FQDN.

Re: FTD/FMC DNS Group objects?

Warren Sullivan - Corp — Wed, 17 Jul 2019 23:52:47 GMT

Awesome, thanks Marvin, your a wealth of knowledge on this platform, it is truly appreciated!

One more quick one, for a FQDN object, do i have to put in the fully qualified name or just the host itself?

for example;

PRD-NPS01 instead of PRD-NPS01.domain.com...

Re: FTD/FMC DNS Group objects?

Marvin Rhoads — Thu, 18 Jul 2019 02:46:27 GMT

The FQDN needs to be fully qualified. The FTD device doesn't know to append a local domain.

Note that FQDN objects can only be used in Access Control and prefilter rules. You must have setup DNS both as a DNS Server Group object in FMC as well as per device that will be using the objects (Devices > Platform Settings and then "Enable DNS name resolution by device").