FQDN addresses with wildcards

[nothingel]

It's my understanding that wildcards are not supported in FQDN address objects and this is confirmed by the statement "Wildcards are not supported in FQDN address objects" (FortiOS Handbook v5.2.3, page 915).

However, a factory reset of v5.2.4 on a 60C revealed many FQDN address objects with wildcards.  Below is the first few:

config firewall address
    edit "apple"
        set type fqdn
        set fqdn "*.apple.com"
    next
    edit "dropbox.com"
        set type fqdn
        set fqdn "*.dropbox.com"
    next
    edit "Gotomeeting"
        set type fqdn
        set fqdn "*.gotomeeting.com"
    next

The above entries appear to be referenced in the following (meaning, they could not be removed until cleaning up the following):

config firewall ssl-ssh-profile
    edit "deep-inspection"

From sniffing DNS traffic from the Fortigate (which is near-constant due to the above FQDN objects), it appears that the "wildcard" entries are interpreted as a literal name and in most cases, no address is returned.

Why does the default configuration include FQDN with wildcards when they're not supposed to work according to the manual?

Thanks!

[Dave_Berger]

https://forum.fortinet.com/FindPost/130434