Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Tutek
New Contributor

Create firewall rule for CDN zimbra

Hi,

how could I create firewall rule that allow web access to "repo.zimbra.com" every time when I ping this site I get respond from other *.cloudfrond.net server with different ip.

I have created a rule with destination fqdn "repo.zimbra.com" but fortigate is resolving different ip that when this domain is pinged. So this rule do not work and I don't have access. 

Fortigate resolve this domain:

repo.zimbra.com.jpg

 

when I ping this site ip addresses are different every time:

54.192.231.77

54.192.231.125
54.192.231.91
54.192.231.13
54.192.231.19

 

PING repo.zimbra.com.jpg

3 REPLIES 3
pminarik
Staff
Staff

As far as DNS goes, the only thing you can do is ensure that both the FortiGate and your client PC use the same DNS server (e.g. internal DC with DNS role). Done this way, the chances for the FQDN resolving differently should be minimised.

[ test signature, please ignore ]
ssudhakar
Staff
Staff

Hi Tutek,

 

-Make sure  the DNS settings on FortiGate and the client machine are the same so that they resolve to the same IP addresses.

- If the issue still persists after configuring the same DNS  both FortiGate and client machine and if the destination FQDN resolves to a different IP very frequently, try using a wildcard FQDN object instead of the full regular FQDN.

- Below are KBs that explain how a wildcard FQDN works

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-FQDN-based-firewall-policies-are-not-worki...

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-wildcard-FQDN/ta-p/196118

 

Please let me know if that helps.

 

Thank you,

Hope.

 

Tutek
New Contributor

Client (accesing zimbra repo):

-dns set to google

 

root@srv:/home/# ping repo.zimbra.com
PING d1bynvv8c88s02.cloudfront.net (54.192.231.13) 56(84) bytes of data.
64 bytes from server-54-192-231-13.waw50.r.cloudfront.net (54.192.231.13): icmp_seq=1 ttl=244 time=7.15 ms
64 bytes from server-54-192-231-13.waw50.r.cloudfront.net (54.192.231.13): icmp_seq=2 ttl=244 time=7.33 ms
64 bytes from server-54-192-231-13.waw50.r.cloudfront.net (54.192.231.13): icmp_seq=3 ttl=244 time=6.97 ms

 

 

 

My pc with the same dns google:

 

C:\Users\Wojtek>ping repo.zimbra.com
Pinging d1bynvv8c88s02.cloudfront.net [54.192.231.91] with 32 bytes of data:
Reply from 54.192.231.91: bytes=32 time=7ms TTL=244
Reply from 54.192.231.91: bytes=32 time=7ms TTL=244
Reply from 54.192.231.91: bytes=32 time=7ms TTL=244
Reply from 54.192.231.91: bytes=32 time=7ms TTL=244

 

When I set on fortigate in policy destination as *.zimbra.com then it resolve to:

(fortigate has fortiguard dns servers)

52.222.158.17

52.222.158.99

52.222.158.121

52.222.158.76

52.206.229.23