Dynamic resolution of fully qualified domain name (FQDN) address objects in policy definitions

Patent metadata

Field	Value
Publication number	US-9503424-B2
Application number	US-201514807763-A
Country	US
Kind code	B2
Filing date	Jul 23, 2015
Priority date	May 25, 2011
Publication date	Nov 22, 2016
Grant date	Nov 22, 2016

Abstract

Dynamic resolution of Fully Qualified Domain Name (FQDN) address objects in policy definitions is provided. In some embodiments, dynamic resolution of Fully Qualified Domain Name (FQDN) address objects in policy definitions includes receiving a network policy that includes a domain name (e.g., the network policy can include a network security rule that is based on the domain name); and periodically updating Internet Protocol (IP) address information associated with the domain name by performing a Domain Name Server (DNS) query. In some embodiments, dynamic resolution of Fully Qualified Domain Name (FQDN) address objects in policy definitions includes dynamically performing a first local Domain Name Server (DNS) lookup for a first VSYS using a first DNS server on a first domain name for implementing a network policy based on the first domain name; dynamically performing a second local DNS lookup for a second VSYS using a second DNS server on the first domain name for implementing the network policy based on the first domain name; in which the network policy includes a network security rule that is based on the first domain name, and the network policy includes a network security rule that is based on the second domain name.

First claim

What is claimed is:

1. A system, comprising:
a processor configured to:
receive a network policy that includes a domain name, wherein the domain name includes a Fully Qualified Domain Name (FQDN);
periodically update Internet Protocol (IP) address information associated with the domain name by performing a Domain Name Server (DNS) query, wherein update the IP address information comprises:
determine whether the domain name has been resolved;
in the event that the domain name has not been resolved, attempt to resolve the domain name; and
in the event that the domain name has been resolved, check whether the IP address information associated with the domain name has changed; and

in the event that the network policy is to be enforced and the IP address information associated with the domain name has not been updated, dynamically perform a resolution of the domain name to enforce the network policy based on the domain name; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1 , wherein the system includes a security appliance, and wherein the security appliance includes a firewall.

3. The system recited in claim 1 , wherein the IP address information includes Internet Protocol Version 4 (IPv4) information or Internet Protocol Version 6 (IPv6) information.

4. The system recited in claim 1 , wherein the IP address information is periodically updated based on a Time To Live (TTL) value.

5. The system recited in claim 1 , wherein the IP address information is periodically updated based on a system frequency.

6. The system recited in claim 1 , wherein the IP address information is periodically updated based on a configuration setting.

7. The system recited in claim 1 , wherein the IP address information is periodically updated based on an event.

8. The system recited in claim 1 , wherein the network policy includes a network security rule that is based on the domain name.

9. The system recited in claim 1 , wherein the network policy includes a network security rule that is based on the domain name, and wherein the network policy includes one or more of the following rules based on the domain name: a routing rule, a Quality of Service (QoS) rule, and a workload balancing rule.

10. The system recited in claim 1 , wherein the domain name only includes a subset of the FQDN, and the policy includes a host name that is not specified as the FQDN.

11. The system recited in claim 1 , wherein update the IP address information further comprises:
execute a dynamic resolver, wherein the dynamic resolver performs the periodically update the IP address information associated with the domain name.

12. The system recited in claim 1 , wherein the processor is further configured to:
dynamically perform a resolution of the domain name using a central management system for implementing the network policy based on the domain name, wherein the domain name was not necessarily resolved or updated prior to enforcing the network policy.

13. The system recited in claim 1 , wherein the processor is further configured to:
enforce the network policy based on the IP address, wherein the IP address is associated with the domain name, and the policy includes a rule or action based on the domain name.

14. The system recited in claim 1 , wherein the processor is further configured to:
enforce the network policy based on the IP address, wherein the IP address is associated with the domain name, and the policy includes a rule or action based on the domain name; and
monitor events based on a context sensitive resolution of the domain name.

15. The system recited in claim 1 , wherein the processor is further configured to:
store the domain name, the IP address information associated with the domain name, and a Time To Live (TTL) value for the IP address information associated with the domain name.

16. The system recited in claim 1 , wherein the processor is further configured to:
store the domain name, a plurality of IP addresses associated with the domain name, and a Time To Live (TTL) value for each of the plurality of IP addresses associated with the domain name in a data store including one or more tables.

17. The system recited in claim 1 , wherein the processor is further configured to:
report events based on network security threats, wherein the reported events include one or more domain names associated with at least one of the network security threats.

18. A method, comprising:
receiving a network policy that includes a domain name, wherein the domain name includes a Fully Qualified Domain Name (FQDN);
periodically updating Internet Protocol (IP) address information associated with the domain name by performing a Domain Name Server (DNS) query, wherein periodically updating the IP address information comprises:
determining whether the domain name has been resolved;
in the event that the domain name has not been resolved, attempting to resolve the domain name; and
in the event that the domain name has been resolved, checking whether the IP address information associated with the domain name has changed; and

in the event that the network policy is to be enforced and the IP address information associated with the domain name has not been updated, dynamically performing a resolution of the domain name to enforce the network policy based on the domain name.

19. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
receiving a network policy that includes a domain name, wherein the domain name includes a Fully Qualified Domain Name (FQDN);
periodically updating Internet Protocol (IP) address information associated with the domain name by performing a Domain Name Server (DNS) query, wherein periodically updating the IP address information comprises:
determining whether the domain name has been resolved;
in the event that the domain name has not been resolved, attempting to resolve the domain name; and
in the event that the domain name has been resolved, checking whether the IP address information associated with the domain name has changed; and

in the event that the network policy is to be enforced and the IP address information associated with the domain name has not been updated, dynamically performing a resolution of the domain name to enforce the network policy based on the domain name.

20. The method of claim 18 , wherein the IP address information includes Internet Protocol Version 4 (IPv4) information or Internet Protocol Version 6 (IPv6) information.

21. The method of claim 18 , wherein the IP address information is periodically updated based on a Time To Live (TTL) value.

22. The method of claim 18 , wherein the IP address information is periodically updated based on a system frequency.

23. The method of claim 18 , wherein the IP address information is periodically updated based on a configuration setting.

24. The method of claim 18 , wherein the IP address information is periodically updated based on an event.

25. The method of claim 18 , wherein the network policy includes a network security rule that is based on the domain name.

26. The method of claim 18 , wherein the network policy includes a network security rule that is based on the domain name, and wherein the network policy includes one or more

Assignees

• Palo Alto Networks Inc

Inventors

• Bharali Anupam
• Ghatge Ajay
• Ithal Ravi

Classifications

• H04L63/02 Primary

  for separating internal from external traffic, e.g. firewalls · CPC title

• H04L61/1511

  Electricity · mapped topic

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04L63/0236 Primary

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title