1. Policies by FQDN
WatchGuard Training

2. Policies by FQDN
RFE36954: Ability to use FQDN in policies and blocked sites lists
RFE27064: Ability to use FQDN in From and/or To field in policies
RFE79740: Ability to use FQDN in From and/or To field in policies
WatchGuard Training

3. Policies by FQDN What it is… What it isn’t…
FQDN as part of the source and/or destination of a policy
FQDN as part of an alias
FQDN for a blocked site
FQDN for a blocked site exception
Wildcards for the host on a domain (*.example.com)
What it isn’t…
FQDN resolved to IPv6 addresses
FQDN for server configurations (Log Server, SSO Agent, etc.)
WatchGuard Training

4. Use Cases
WatchGuard Training

5. Use Cases Allow traffic to a specific domain using a separate policy
Allow traffic to software update sites such as windowsupdate.microsoft.com or antivirus signature update sites, even though all other traffic is blocked. This is especially useful when these sites are hosted on content delivery networks (CDNs) that frequently add and change IP addresses.
Deny traffic to a specific domain
Deny all traffic from CDE (Cardholder Data Environment) but allow signature updates
For PCI compliance traffic from the CDE must be restricted, however allowing critical updates is still necessary. Many of the services that need to be allowed are also using CDNs
WatchGuard Training

6. Configuration
WatchGuard Training

7. FQDN in Policies When modifying the To or From fields in a policy,
FQDN is now listed in after selecting Add > Add Other
This allows the configuration of a FQDN and can include a single leading wildcard.
WatchGuard Training

8. FQDN in Aliases
FQDN members can also be added to aliases, which are then used in policies.
WatchGuard Training

9. FQDN in Blocked Sites (and Exceptions)
FQDN members can also be added to the blocked sites, and blocked sites exceptions lists.
WatchGuard Training

10. FQDN in Logging
Logging will show the FQDN that was matched in the logs when a policy is applied to traffic by FQDN.
WatchGuard Training

11. FQDN in Reporting
Reporting will show the FQDN that was matched when the policy was applied to traffic by FQDN.
WatchGuard Training

12. FQDN in Reporting
Blocked Sites will identify the IP addresses blocked by FQDN included in the configuration.
WatchGuard Training

13. How does this work?
WatchGuard Training

14. Forward Lookups
When a user configures a domain name, the system will perform forward DNS resolution and store the mapping.
Clients and the Firewall should use the same name servers.
For example:
Non-authoritative answer:
Name:
Address:
Address:
Address:
Address:
Address:
Address:
WatchGuard Training

15. Why not Reverse lookups?
It is natural to think that we might be able to perform reverse DNS resolution on the source or destination IP when receiving a traffic, and see if the resolved FQDN matches the configuration.
Unfortunately, reverse DNS resolution might not always work. Quite commonly, the reverse DNS resolution result is not what you might expect.
For example: (from our previous lookup to
Non-authoritative answer:
in-addr.arpa name = pa-in-f147.1e100.net.
WatchGuard Training

16. What about Wildcards?
With Wildcards we do forward lookups for www and the domain itself
For example: *.google.com we resolve and google.com
To resolve the rest of the hosts implied by *.google.com, we implement DNS sniffing for A records that match our configuration.
As DNS traffic passes through the firewall, we learn the responses to relevant queries.
WatchGuard Training

17. What happens when don’t we see responses?
As seen here, if the clients are trying to reach an internal destination with an internal name server, the firewall may not have an opportunity to sniff this traffic for local servers.
We recommend that internal name servers are on a different internal network than clients to ensure the firewall can see responses from the server.
WatchGuard Training

18. Thank You!
WatchGuard Training