Control Access to Domains
Domains in destination lists must comply with the format described in RFC-1035. You may not use wildcards in domains in destination lists; Secure Access assumes implied left wildcards in domain entries. A domain in a destination list matches traffic to all paths in that domain and its subdomains.
| Destination list entry: | Matches all traffic where the domain matches: |
|---|---|
example.com
|
*.example.com
|
www.example.com
|
*.www.example.com
|
For more information about troubleshooting possible error conditions with destination lists, see Troubleshoot Destination Lists.
Depending on what you want to do, you may need multiple web access rules and destination lists. Remember:
- Order rules from specific to general.
- The default internet access rule is set to allow; the default private access rule is block. (See Edit or View the Default Access Rules.
- Allowed traffic is still subject to security controls (see Security Controls for Internet Access Rules) and the DLP policy (see Manage the Data Loss Prevention Policy).
The following web access rule examples illustrate how you can use destination lists to control access to a public internet domain:
- To block all traffic to
example.com:- Create Rule A with the block action, using a destination list containing
example.com.
- Create Rule A with the block action, using a destination list containing
- To block traffic to a subdomain and allow traffic to the rest of the domain continue to
match rules:
- Create Rule A with the block action using a destination, list containing
sub.example.com.
- Create Rule A with the block action using a destination, list containing
- To allow traffic to a subdomain, but block the rest of the domain:
- Create Rule A with the allow action, using a destination list containing
sub.example.com. - Create Rule B with the block action, using a destination list with
example.com.
- Create Rule A with the allow action, using a destination list containing