Create firewall rule for CDN zimbra

[Tutek]

Hi,

how could I create firewall rule that allow web access to "repo.zimbra.com" every time when I ping this site I get respond from other *.cloudfrond.net server with different ip.

I have created a rule with destination fqdn "repo.zimbra.com" but fortigate is resolving different ip that when this domain is pinged. So this rule do not work and I don't have access. 

Fortigate resolve this domain:

when I ping this site ip addresses are different every time:

54.192.231.77

54.192.231.125
54.192.231.91
54.192.231.13
54.192.231.19

 

 

[pminarik]

As far as DNS goes, the only thing you can do is ensure that both the FortiGate and your client PC use the same DNS server (e.g. internal DC with DNS role). Done this way, the chances for the FQDN resolving differently should be minimised.

[ssudhakar]

Hi Tutek,

-Make sure  the DNS settings on FortiGate and the client machine are the same so that they resolve to the same IP addresses.

- If the issue still persists after configuring the same DNS  both FortiGate and client machine and if the destination FQDN resolves to a different IP very frequently, try using a wildcard FQDN object instead of the full regular FQDN.

- Below are KBs that explain how a wildcard FQDN works

https://community.fortinet.com/t5/FortiGate/Technical-Tip-FQDN-based-firewall-policies-are-not-worki...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-wildcard-FQDN/ta-p/196118

Please let me know if that helps.

Thank you,

Hope.

[Tutek]

Client (accesing zimbra repo):

-dns set to google

root@srv:/home/# ping repo.zimbra.com
PING d1bynvv8c88s02.cloudfront.net (54.192.231.13) 56(84) bytes of data.
64 bytes from server-54-192-231-13.waw50.r.cloudfront.net (54.192.231.13): icmp_seq=1 ttl=244 time=7.15 ms
64 bytes from server-54-192-231-13.waw50.r.cloudfront.net (54.192.231.13): icmp_seq=2 ttl=244 time=7.33 ms
64 bytes from server-54-192-231-13.waw50.r.cloudfront.net (54.192.231.13): icmp_seq=3 ttl=244 time=6.97 ms

My pc with the same dns google:

C:\Users\Wojtek>ping repo.zimbra.com
Pinging d1bynvv8c88s02.cloudfront.net [54.192.231.91] with 32 bytes of data:
Reply from 54.192.231.91: bytes=32 time=7ms TTL=244
Reply from 54.192.231.91: bytes=32 time=7ms TTL=244
Reply from 54.192.231.91: bytes=32 time=7ms TTL=244
Reply from 54.192.231.91: bytes=32 time=7ms TTL=244

When I set on fortigate in policy destination as *.zimbra.com then it resolve to:

(fortigate has fortiguard dns servers)

52.222.158.17

52.222.158.99

52.222.158.121

52.222.158.76

52.206.229.23