Skip to main content
Morus
Morus
New Member
June 16, 2025
Question

FQDN Wildcard Object

  • June 16, 2025
  • 1 reply
  • 608 views

Hi!

So i'm facing a strange issue with wildcard address object (FQDN).

If i configure the object as *.learn.microsoft.com i cannot reach anything from my client, not even the "microsoft.com" domain.

If i configure it as *.microsoft.com i can reach the website and all the subdomain (lean.microsoft.com included).

i've already configured the "config system session-helper" for DNS traffic. If i run "diag test application dnsproxy 6" looks like my FGT cannot resolve the subdomain:

Immagine 2025-06-16 175348.png

 

I found this old technical tip where its says that wildcard FQDN should not be used in firewall policies.

Any suggestion?

1 reply

AEK
SuperUser
AEK
SuperUser
June 16, 2025

Hi Morus

I agree that wildcard address object should not be used, or at least should be used with caution. Windcard are not resolved by FG until a host tries resolve the address using a clear DNS query. But today's browsers usually send DNS query over TLS or HTTPS, so FG can't see the result (except probably if you use deep inspection).

Try use the wildcard it in a Web Filter instead.

AEK
Terms & ConditionsAccessibility statement