Skip to main content
nothingel
New Member
September 17, 2015
Question

FQDN addresses with wildcards

  • September 17, 2015
  • 1 reply
  • 10814 views

It's my understanding that wildcards are not supported in FQDN address objects and this is confirmed by the statement "Wildcards are not supported in FQDN address objects" (FortiOS Handbook v5.2.3, page 915).

 

However, a factory reset of v5.2.4 on a 60C revealed many FQDN address objects with wildcards.  Below is the first few:

 

config firewall address
    edit "apple"
        set type fqdn
        set fqdn "*.apple.com"
    next
    edit "dropbox.com"
        set type fqdn
        set fqdn "*.dropbox.com"
    next
    edit "Gotomeeting"
        set type fqdn
        set fqdn "*.gotomeeting.com"
    next

 

The above entries appear to be referenced in the following (meaning, they could not be removed until cleaning up the following):

 

config firewall ssl-ssh-profile
    edit "deep-inspection"

 

From sniffing DNS traffic from the Fortigate (which is near-constant due to the above FQDN objects), it appears that the "wildcard" entries are interpreted as a literal name and in most cases, no address is returned.

 

Why does the default configuration include FQDN with wildcards when they're not supposed to work according to the manual?

 

Thanks!

 

    1 reply

    Dave_Berger
    New Member
    October 28, 2015