Sophos UTM: Decommissioning of obsolete URL categorization services CFFS. Click here for important info.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DNAT rule to publish FQDN?

I'm migrating to an XGS136 (SFOS 19.5.1 MR-1-Build278).

The old firewall published LDAPS on 2 DCs to a specific WAN server that needs to do LDAPS lookups for AD integration. The destination device was set to an FQDN object corresponding to the internal domain name ("domain.local"). The intent was to make the firewall do a lookup against internal DNS servers to obtain IP addresses of the DCs. (As you may know, a "domain.local" record is created automatically in internal DNS when an AD domain is created, and querying it returns all DCs in the domain.)

This rule has worked on the old firewall.

I'm now attempting to re-create this rule on the XGS using "Server Access Assistant (DNAT)". I can only choose IP objects as the internal server. I can't choose FQDN objects. However, after I create the rule I can edit it to change the destination to the FQDN object.

I can certainly create an IP list object of DCs and use that instead of the FQDN object, but using the FQDN makes coordination automatic if I stand up a new DC, decommission one, or change a DC's IP address. AD will always update the "domain.local" DNS record.

Is there any reason I shouldn't be doing this?



This thread was automatically locked due to age.
Parents Reply
  • I agree...in IT, abstraction is generally a good thing.

    So now I'm wondering why the DNAT rule wizard only offers IP objects for the internal server. SFOS even has an object-picker that includes a filter for object type, including FQDN objects; It's right there in the NAT rule editor. If that was by design, it was an odd choice.

    Even odder...I created a temporary IP object so I could make sure I was modifying the correct NAT rule to change to the FQDN object after rule creation. After I changed to the FQDN object I went to delete the temporary object, and it wouldn't let me. Told me it was in use by a rule, but it's not. That's a bug. 

Children
No Data