Firewall rules using fully qualified domain names fail to match

Technical Articles ID: KB87125
Last Modified: 2022-03-10 05:29:13 Etc/GMT

Environment

Endpoint Security (ENS) Firewall 10.x

Problem

Firewall rules that contain fully qualified domain name (FQDN) remote matches for inbound or outbound traffic aren't matched.
A match occurs only if there's a DNS request for that FQDN host name.

Cause

This issue is a design limitation of the ENS DNS cache implementation. The DNS cache is built based on DNS responses that ENS Firewall sees.
DNS and WINS name lookups or Windows "hosts" file name resolution are needed to resolve the FQDN host name to an IP address.
Unless the system is performing the name resolution lookup, ENS Firewall doesn't cache it.
An FQDN host name entry within a firewall rule works only if the ipconfig /displaydns command output shows the correct FQDN-to-IP address name resolution mapping.

Solution

To submit a new product idea, go to the Enterprise Customer Product Ideas page.

Click Sign In and enter your ServicePortal User ID and password. If you do not yet have a ServicePortal or Community account, click Register to register for a new account on either website.

For more information about product ideas, see KB60021 - How to submit a Product Idea.

Workaround

You must use an IP address in place of an FQDN when the inbound or outbound firewall rules are defined.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Firewall rules using fully qualified domain names fail to match

Environment

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

Firewall rules using fully qualified domain names fail to match

Environment

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Choose your region

Title

Title