Firewall rules for dns objects - what is the fix

[carl_townshend]

Hi All

We use a cloud based url filtering product but we seem to run into issues with some servers that bypass this and need to go to the internet direct.

the issue with this is when we allow IP based rules, they seem to constantly change and so we need to amend the rule again.

What would be the best fix for this?

some firewalls use dns based objects such as Checkpoint, but they affect firewall performance.

what are the options?

would you need to run a local on prem proxy to fix this?

cheers

[rdz586]

Hi Carl,

I have used FQDN's on Cisco ASA / FortiGate firewalls previously and have had no issues with performance issues, although it will depend on firewall model and how many rules you plan to use FQDN's for.

I would normally use IP addresses if you can and only use FQDN's when the IP address is likely to change frequently, which are usually IP addresses in public cloud environments from experience.

[Rob Ingram]

Hi,

Yes, using DNS in ACL is supported on ASA, Cisco guide here. If you are using FTD you could use URL Filtering instead of DNS to resolve the hostname.

HTH