|
A common practice when implementing a WebFiltering FortiProxy is using the same address type (FQDNs) as in FortiGate firewall rules for the black list.
This has the sometimes unintended effect of FortiProxy resolving periodically the FQDNs in the black list.
If FortiProxy is used on a secure environment where the DNS resolution is also controlled/monitored by the security team, they can receive alerts about forbidden sites resolutions coming from FPX.
This could trigger false positives about forbidden activity or be interpreted as FPX users trying to browse to blocked sites.
The behavior of the FQDN address type is to resolve the value to get the corresponding IP addresses.
For example:
This entry is not resolved because it contains a wildcard ('*'):
# edit ".bad-site.example"
# set type fqdn
# set fqdn "*.bad-site.example"
# next
This one is resolved, and is not a wildcard.
# edit "badsite.example"
# set type fqdn
# set fqdn "badsite.example"
# next
In order to avoid DNS resolution, use the 'Host Regex' address type instead of FQDN:
# edit "badsite.example"
# set type host-regex
# set host-regex "badsite.example"
# next
|
