Fortigate - Redirecting subdomains only?

Question

I'm trying to figure out a way to have our Fortigate 60C redirect certain subdomains but not block complete access to the domain.

E.G. I want to block update.microsoft.com but I don't want microsoft.com or office.microsoft.com to be blocked.

My current settings are blocking the complete domain. I do find this strange though as I specified a hostname.

config system dns-database 

edit "test" 

config dns-entry 

edit 2 

set hostname "update" 

set ip 1.1.1.1 

next

end

set domain "microsoft.com"

My goals is to prevent certain software from accessing certain urls to prevent devices from downloading updates or phoning home.

1.1.1.1 is set as a loopback.

Blocking access on devices itself is not an option.

Answer 1

I believe you would want to use a "DNS Filter" for this. It has an option to block domains via a "Static Domain Filter". In it, you can specify any combination of subdomains, which will be easier to manage than the dns-database option. Then, you can apply the DNS Filter to any relevant IPv4 Policy objects which should block access to those respective domains.

For example (shown from OS 5.6):

config dnsfilter domain-filter
    edit 0
        set name "block-updates"
        config entries
            edit 1
                set domain "updates.microsoft.com"
                set action block
            next
        end
    next
end

Note what ID number is created from the above block, and use it as <id> in the block below. (And note that tab expansion will also work.)

config dnsfilter profile
    edit "Block Updates"
        config domain-filter
            set domain-filter-table <id>
        end
    next
end

It's a bit easier to configure in the GUI, as there's no back and forth between the domain list and the profile.

Then enable it on one or more policies:

config firewall policy
    edit <id>
        set utm-status enable
        set dnsfilter-profile "Block Updates"
    next
end