Create firewall rule for CDN zimbra

As far as DNS goes, the only thing you can do is ensure that both the FortiGate and your client PC use the same DNS server (e.g. internal DC with DNS role). Done this way, the chances for the FQDN resolving differently should be minimised.

Hi Tutek,

-Make sure  the DNS settings on FortiGate and the client machine are the same so that they resolve to the same IP addresses.

- If the issue still persists after configuring the same DNS  both FortiGate and client machine and if the destination FQDN resolves to a different IP very frequently, try using a wildcard FQDN object instead of the full regular FQDN.

- Below are KBs that explain how a wildcard FQDN works

https://community.fortinet.com/t5/FortiGate/Technical-Tip-FQDN-based-firewall-policies-are-not-working/ta-p/196844?externalID=FD52587

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-wildcard-FQDN/ta-p/196118

Please let me know if that helps.

Thank you,

Hope.

Client (accesing zimbra repo):

-dns set to google

root@srv:/home/# ping repo.zimbra.com PING d1bynvv8c88s02.cloudfront.net (54.192.231.13) 56(84) bytes of data. 64 bytes from server-54-192-231-13.waw50.r.cloudfront.net (54.192.231.13): icmp_seq=1 ttl=244 time=7.15 ms 64 bytes from server-54-192-231-13.waw50.r.cloudfront.net (54.192.231.13): icmp_seq=2 ttl=244 time=7.33 ms 64 bytes from server-54-192-231-13.waw50.r.cloudfront.net (54.192.231.13): icmp_seq=3 ttl=244 time=6.97 ms

My pc with the same dns google:

C:\Users\Wojtek>ping repo.zimbra.com Pinging d1bynvv8c88s02.cloudfront.net [54.192.231.91] with 32 bytes of data: Reply from 54.192.231.91: bytes=32 time=7ms TTL=244 Reply from 54.192.231.91: bytes=32 time=7ms TTL=244 Reply from 54.192.231.91: bytes=32 time=7ms TTL=244 Reply from 54.192.231.91: bytes=32 time=7ms TTL=244

When I set on fortigate in policy destination as *.zimbra.com then it resolve to:

(fortigate has fortiguard dns servers)

52.222.158.17

52.222.158.99

52.222.158.121

52.222.158.76

52.206.229.23