topic Re: FQDN hosts used in Access Lists in Network Security

FQDN hosts used in Access Lists

Daniel Smith — Fri, 21 Feb 2020 15:40:29 GMT

We have deployed the feature where an object is created, and the firewall checks DNS every minute for the IP of that public host. Example

object network www.sears.com

fqdn www.sears.com

object-group network internet

network-object object www.sears.com

access-list test1 permit tcp any object-group internet eq 80

This works well for a static site. However, if the target site does redirects to other sites for content, the process fails, as those redirected sites are not allowed outbound by the access-list.

I wonder if there is a feature or configuration on the firewall that would enable inspection of the connections for redirects, and then allow those connections?

Re: FQDN hosts used in Access Lists

Marius Gunnerud — Thu, 26 Apr 2018 15:49:00 GMT

You might want to try http inspection using regex, that is if all the redirects are within the sears.com domain. But if the redirects go to other domains then this is not a scaleable solution. A better option would be to invest in a Web proxy such as WSA or FTD with URL filtering.

Another option would be to us Cisco Umbrella and integrate it with your AD.

Re: FQDN hosts used in Access Lists

Florin Barhala — Thu, 26 Apr 2018 19:07:22 GMT

Nice answers - as usual. Is it possible to change DNS lookup process for FQDNs from 1 minute to 5' or 10' ?

Re: FQDN hosts used in Access Lists

Marius Gunnerud — Thu, 26 Apr 2018 19:44:15 GMT

If you mean the delay between lookups, you can do this with the following command

dns expire-entry-timer minutes 10