Addresses vs Wildcard FQDN Addresses

[DrFirewall24]

What is the difference between Addresses vs Wildcard FQDN Addresses on Fortimanager?

[hbac]

Hi @DrFirewall24,

There are different types of address object. Wildcard FQDN address object includes all IP addresses that the FQDN resolves to. 

Regards, 

[DrFirewall24]

Thank you HBAC

[dbu]

Hi @DrFirewall24 ,
When you create a Wildcard FQDN object, initially it is empty without any IP address in it and as soon as client tries to resolve the FQDN all the resolved IPs for that domain will be added to the wildcard object for this FQDN.  These IP addresses are kept in the FQDN object until the DNS entry expires. 
On the other side when you use Addresses object , you are defining what the IP addresses inside it will be. 
For this you will need 

[cwaldner]

But i can input for example *.google.com for and address object with fqdn selected. Is it the same as the wildcard-fqdn? Because the address-object can be used in address-groups.

[FlavioB1]

Hi.

In fact, I'm facing the same question right now. I see that the behavior seems to be identical: both "Wildcard FQDN" and an address object like *.apple.com are the same (resolved IP addresses are populated when clients try to reach apple.com).

I thought the difference would be that in an SSL-inspection profile you could exempt from SSL inspection only "Wildcard FQDN" objects, but this also is not true (you can exempt all address objects as well).

So, the question still stands: what is the exact difference between a Wildcard FQDN (*.apple.com) and an address object *.apple.com?

[pminarik]

Originally, only "config firewall wildcard-fqdn" existed as a place to create objects matching DNS wildcards. This, as far as I remember, was, and still is, only usable in SSL inspection profiles to configure exceptions from inspection.

This object isn't resolved to IPs, the matching is done based on SNI/SAN values observed in TLS handshakes.

Nowadays (since approx 6.2, I think?) you can define wildcard FQDNs in "config firewall address" as well, and these can be used in firewall policies directly. The only requirement for them to work is that the FortiGate sees all client DNS traffic (the list of IPs matching a wildcard is passively generated from observed DNS traffic, it cannot be pro-actively populated).

So the reason for having two ways to configure wildcard FQDNs is purely historical. If this were to be implemented from scratch today, we could hypothesize that it would likely be done with only one of these object types.

[FlavioB1]

Thank you.

So in fact there IS a difference: "Wildcard FQDN" objects do not rely on DNS resolution but simply match SNI/SAN values.

As of today, would you suggest to still use "Wildcard FQDN" objects in SSL-exemptions instead of normal address objects (like *.apple.com)?

[pminarik]

If it still works as I described it (I haven't checked in a long time), a "wildcard FQDN" object should be the more robust option in SSL-exemptions, given its independence from DNS traffic.

[DrFirewall24]

Thank you