FireSight docsDNS names
FireSight can use DNS in three ways: accepting host names on rule requests, showing names for host addresses, and naming the address objects it creates after DNS names. Administrators set it under Settings, Policies & schedules, DNS.
Settings
| Setting | Default | Meaning |
|---|---|---|
| Look up DNS names for host addresses | on | Shows the DNS name of every single-host source and destination, and accepts host names instead of addresses on rule requests. |
| Convert entries to DNS names if available | off | Names the firewall address objects FireSight creates after the host's DNS name instead of its IP address. |
| DNS-named objects match on | IP address (recommended) | IP address keeps matching the address the request was approved for. FQDN (follows DNS) makes the firewall follow DNS, so the object changes if the DNS record changes. |
| DNS servers | empty | Comma-separated IP addresses. Leave empty to use the FireSight server's own resolver. |
Host names on requests
With lookups on, a requester can type a host name as a source or destination. FireSight resolves it (forward DNS) when it plans and saves the request, and plans with its addresses. A name that doesn't resolve is refused (… doesn't resolve to any address). With lookups off, host names are refused (… is a hostname, but DNS lookups are turned off in Settings).
The request keeps the addresses that were approved. Approvers see the name next to each address.
Names for addresses
Every single-host address (/32 or /128) is looked up in reverse DNS. The name is shown:
- under DNS while the request is planned;
- next to the address under From and To on the request page.
Lookups use a short timeout and are cached briefly, so a slow resolver never holds up the form.
Objects named after DNS
With Convert entries to DNS names if available on, single-host objects that FireSight creates are named after the host's DNS name. See Objects, services and naming.
IP address (recommended) is the safer choice: the object keeps matching exactly what was approved, whatever happens to the DNS record later. Choose FQDN only if you want the firewall to follow DNS changes.