Akamaitechnologies and FQDN firewall rulle

[Jdtjordan1983]

I have HIPs 8.0.0.4990 and I need to authorize access to a specific FQDN that is hosted on Akamai (meaning the IP address that resolves can change often).

I have noticed that in this case, the 1st time the rule is matched, a name lookup is performed and the traffic is allowed. Once the akamai IP address has been updated, the traffic is no longer allowed, since a new name lookup is not performed and hIPS caches the old IP.

This basically renders the FQDN functionality in the hIPS FW rules useless, unless there is a way to force it to perform a dns lookup with every connection to see if the IP changed.

Suggestions, please.

#hostintrusionprevention #epo 

[ktankink]

@Jdtjordan1983 Please see KB71322.  The system must perform a new DNS query in order for the HIPS engine to cache the new IP address; HIPS does not do this DNS resolution on its own.

KB71322 - FQDN lookups for Host Intrusion Prevention 8.0
https://kc.mcafee.com/corporate/index?page=content&id=KB71322

[Jdtjordan1983]

Hello,

Thank you for the KB article, but it doesn't display how to enable DNS parsing with HIPS 8.0. Could you possibly tell me how to enable the DNS parsing within HIPS 8.0?

Thank you!

[ktankink]

It's not something you can toggle off or on..  When the operating system performs DNS lookups, the HIPS engine will automatically cache the IP results.  The KB is showing a change from HIPS 7 to HIPS 8.  With HIPS 7, the HIPS Firesvc.exe service would actually perform the DNS lookups and that was changed with HIPS 8.0.

There are no options to configure with HIPS 8.0 in regards to DNS lookups/parsing; it's all done automatically via code.

[Jdtjordan1983]

Is it not possible to add a wildcard to the FQDN within HIPs? 

[ktankink]

FQDN is defined as "fully qualified", so wildcards are not acceptable.