FQDN addresses
By using Fully Qualified Domain Name (FQDN) addressing you can take advantage of the dynamic ability of DNS to keep up with address changes without having to manually change the addresses on the FortiGate. FQDN addresses are most often used with external web sites but they can be used for internal web sites as well if there is a trusted DNS server that can be accessed. FQDN addressing also comes in handy for large web sites that may use multiple addresses and load balancers for their web sites. The FortiGate firewall automatically maintains a cached record of all the addresses resolved by the DNS for the FQDN addresses used.
For example, if you were doing this manually and you wanted to have a security policy that involved Google, you could track down all of the IP addresses that they use across multiple countries. Using the FQDN address is simpler and more convenient.
When representing hosts by an FQDN, the domain name can also be a subdomain, such as mail.example.com.
Valid FQDN formats include:
-
<host_name>.<top_level_domain_name>, such as example.com
-
<host_name>.<second_level_domain_name>.<top_level_domain_name>, such as mail.example.com.
The FortiGate firewall keeps track of the DNS TTLs so as the entries change on the DNS servers the IP address will effectively be updated for the FortiGate. As long as the FQDN address is used in a security policy, it stores the address in the DNS cache.
|
There is a possible security downside to using FQDN addresses. Using a fully qualified domain name in a security policy means that your policies are relying on the DNS server to be accurate and correct. Should the DNS server be compromised, security policies requiring domain name resolution may no longer function properly. |
To create a Fully Qualified Domain Name address:
-
Go to Policy & Objects > Addresses.
- Select Create New > Address.
-
In the Category field, choose Address.
-
Enter a Name for the address object.
-
In the Type field, select FQDN from the dropdown menu.
-
Enter the domain name in the FQDN field.
-
In the Interface field, leave as the default any or select a specific interface from the dropdown menu.
-
Enable/disable Static route configuration.
-
Enter any additional information in the Comments field.
-
Click OK.