FQDN addresses with wildcards

Silver Member
  • Total Posts : 78
  • Scores: 6
  • Reward points: 0
  • Joined: 2010/07/01 14:03:01
  • Status: offline
2015/09/17 16:29:27 (permalink)

FQDN addresses with wildcards

It's my understanding that wildcards are not supported in FQDN address objects and this is confirmed by the statement "Wildcards are not supported in FQDN address objects" (FortiOS Handbook v5.2.3, page 915).
However, a factory reset of v5.2.4 on a 60C revealed many FQDN address objects with wildcards.  Below is the first few:

config firewall address
    edit "apple"
        set type fqdn
        set fqdn "*.apple.com"
    edit "dropbox.com"
        set type fqdn
        set fqdn "*.dropbox.com"
    edit "Gotomeeting"
        set type fqdn
        set fqdn "*.gotomeeting.com"

The above entries appear to be referenced in the following (meaning, they could not be removed until cleaning up the following):

config firewall ssl-ssh-profile
    edit "deep-inspection"

From sniffing DNS traffic from the Fortigate (which is near-constant due to the above FQDN objects), it appears that the "wildcard" entries are interpreted as a literal name and in most cases, no address is returned.
Why does the default configuration include FQDN with wildcards when they're not supposed to work according to the manual?

1 Reply Related Threads

    Dave Berger
    Bronze Member
    • Total Posts : 21
    • Scores: 4
    • Reward points: 0
    • Joined: 2012/03/23 02:25:15
    • Status: offline
    Re: FQDN addresses with wildcards 2015/10/28 00:09:20 (permalink)
    Jump to:
    © 2020 APG vNext Commercial Version 5.5