FTD · BUILD

FTD-style: a rule that names a host (FQDN objects)

The partner’s server is known by name, www.partner.test, and its address can change. An access rule can name it with an FQDN object: the firewall looks the name up and the rule matches the address it gets. The lookup uses the DNS group of the data interfaces, and FTD1 has none yet. NSO (198.18.0.53), on the Internet side, is a DNS server for the partner’s names.

Cisco FTD-style track · Cisco FTD-style, FTD Manager, Cisco router · 4 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

Objects: an FQDN object PARTNER for www.partner.test. In ACP1, above INSIDE-OUT, a rule NO-PARTNER blocking icmp from INSIDE to OUTSIDE to PARTNER. Deploy.
On FTD1, show fqdn: the name did not resolve, so the rule matches nothing, and PC1 still reaches 198.51.100.1.
DNS Server page: a DNS group OUT-DNS with server 198.18.0.53, used by the data interfaces on outside. Deploy. show fqdn now shows the address.
PC1 can no longer reach www.partner.test (198.51.100.1), and still reaches 198.18.0.53.

Start this lab

Before you start

The firewall resolves FQDN objects when you deploy, and on the device again when the answer expires: clear dns-hosts asks again now. A name that does not resolve matches nothing, so a block rule with it blocks nothing: check show fqdn after every deploy. NAT, prefilter and SSL rules match addresses, so they take host and network objects, not FQDN objects.

Concept

A rule can name a host

An FQDN object holds a host name instead of an address. The firewall resolves it with the DNS of its data interfaces, and access rules that use it match the address it got. When the name points somewhere new, the firewall follows at its next lookup. A name that does not resolve matches nothing.

Concept

A firewall needs names and the right time

A firewall resolves names for itself over its management interface (NTP server names, updates, licensing) and, separately, on its data interfaces. It keeps time by NTP, also over the management interface. Licences, certificates and log times depend on the clock. The defaults point to the Internet, so a site without it needs its own servers.