FQDN Wildcard Object

[Morus]

Hi!

So i'm facing a strange issue with wildcard address object (FQDN).

If i configure the object as *.learn.microsoft.com i cannot reach anything from my client, not even the "microsoft.com" domain.

If i configure it as *.microsoft.com i can reach the website and all the subdomain (lean.microsoft.com included).

i've already configured the "config system session-helper" for DNS traffic. If i run "diag test application dnsproxy 6" looks like my FGT cannot resolve the subdomain:

I found this old technical tip where its says that wildcard FQDN should not be used in firewall policies.

Any suggestion?

[AEK]

Hi Morus

I agree that wildcard address object should not be used, or at least should be used with caution. Windcard are not resolved by FG until a host tries resolve the address using a clear DNS query. But today's browsers usually send DNS query over TLS or HTTPS, so FG can't see the result (except probably if you use deep inspection).

Try use the wildcard it in a Web Filter instead.