Summary
The ability to use
set firewall ipv4 input/forward/output filter rule <1-999999> source/destination fqdn <fqdn> etc and have it check at an interval to update if the fqdn IP has changed.
Use case
Currently we run something like
set firewall ipv4 name ALLOW rule 9999 action accept set firewall ipv4 name ALLOW rule 9999 state new set firewall ipv4 name ALLOW rule 9999 destination fqdn example.com set firewall ipv4 name ALLOW rule 9999 source fqdn foo.example.com ... `
which renders out
user@firewall-1:~$ show firewall ipv4 name ALLOW Ruleset Information --------------------------------- ipv4 Firewall "name ALLOW" Rule Action Protocol Packets Bytes Conditions ------- -------- ---------- --------- ------- -------------------------------------------------------------------- 9999 accept all 0 0 ct state new ip daddr 10.10.10.10 ip saddr 10.11.0.1 accept
But when the source or dest IP changes the firewall rules do not.
Additional information
I think adding a helper script that checks that fqdn periodically and update the firewall rule would be beneficial, It is done with the geo-ip Includes cron script (manually callable by op-mode update geoip) to keep database and rules updated.
Another possible would be to add a check-period option to the fqdn options that would apply that as an interval to a cron/scheduled task?
set firewall ipvX xxx rule xxx source/dest fqdn <fqdn.com> check-period 5m