New Member

Question

Addresses vs Wildcard FQDN Addresses

Forum|Forum|2 years ago
March 26, 2024
12 replies
7267 views

What is the difference between Addresses vs Wildcard FQDN Addresses on Fortimanager?

Fortimanager

Hong_FTNT

Staff & Editor

Hi @DrFirewall24,

There are different types of address object. Wildcard FQDN address object includes all IP addresses that the FQDN resolves to.

Regards,

DrFirewall24Author

New Member

Thank you HBAC

dbu

Staff

Hi @DrFirewall24 ,
When you create a Wildcard FQDN object, initially it is empty without any IP address in it and as soon as client tries to resolve the FQDN all the resolved IPs for that domain will be added to the wildcard object for this FQDN. These IP addresses are kept in the FQDN object until the DNS entry expires.
On the other side when you use Addresses object , you are defining what the IP addresses inside it will be.
For this you will need

cwaldner

New Member

But i can input for example *.google.com for and address object with fqdn selected. Is it the same as the wildcard-fqdn? Because the address-object can be used in address-groups.

FlavioB1

Explorer III

Hi.

In fact, I'm facing the same question right now. I see that the behavior seems to be identical: both "Wildcard FQDN" and an address object like *.apple.com are the same (resolved IP addresses are populated when clients try to reach apple.com).

I thought the difference would be that in an SSL-inspection profile you could exempt from SSL inspection only "Wildcard FQDN" objects, but this also is not true (you can exempt all address objects as well).

So, the question still stands: what is the exact difference between a Wildcard FQDN (*.apple.com) and an address object *.apple.com?

jtrimmer

New Member

The only problem with a "wildcard FQDN" is you can't delete it. You can add/remove it from SSL/SSH inspection but after you remove the address from the profile there is no way to remove them. It creates a problem when you create one to troubleshoot an issue but find out it's not the issue. You then remove it from the profile but it's stuck in the list forever. Anyone know how to delete from the list?

FlavioB1

Explorer III

If you can't delete it, it is still referenced/used somewhere.

Can you show us what you're doing and how?

Sign up

Login with SSO

Login to the community

Login with SSO