A fully qualified domain name (FQDN) is the complete domain name for a specific host on the Internet. FQDNs are used in firewall rules to allow or reject traffic going to specific domains.

The FQDN attribute type is used in distributed firewall FQDN Filtering policy, see FQDN Filtering. NSX supports custom FQDNs that are defined by an administrator in addition to the pre-defined list of FQDNs.
Note: Custom FQDNs do not support custom top level domain names.
Custom FQDN supports the following:
  • Starting in 4.1.2, FQDN supports the caret (^) wildcard. The caret wildcard (^) matches a single word and not multiple words. For example, ax^.domain.com can match ax1.domain.com, but will not match ax.sub.domain.com.
  • Starting in 4.1.2, the wildcard character * can be used at the end of the first label. The character * may represent mutliple words. For example, ax*.domain.com can match both ax1.domain.com and ax.sub.domain.com.
  • Starting in 4.0.1, FQDN supports processing of DNS response record packets containing canonical names (CNAMEs).
  • FQDN supports partial wildcards with * at the beginning of a string such as *.eng.northpole.com or *.yahoo.com. The character * may represent mutliple words. For example, ax*.domain.com can match both ax1.domain.com and ax.sub.domain.com.
  • Wildcard characters are allowed only in the first word of the FQDN.
  • Wildcard characters are allowed at the beginning or at the end of the first word, not in the middle
  • More than two wildcard characters in the domain name are not allowed.
  • Full FQDN names are supported, such as maps.google.com or myapp.corp.com
  • The length of each label in FQDN must be between 1 and 63 characters.
  • FQDNs must end with IANA registered top level domains (TLDs) such as .com, .org, or .net etc.
When creating a custom FQDN, using a wildcard domain is a best practice. For example, using *.example.com, would include sub domains such as americas.example.com and emea.example.com. Using example.com, would not include any sub domains.

Procedure

  1. From your browser, log in with admin privileges to an NSX Manager at https://<nsx-manager-ip-address>.
  2. Select Inventory > Profiles.
  3. Select the Attribute Types tab, and FQDNs.
    A table of system-generated FQDNs appears.
  4. Select Actions > Add FQDN.
  5. Enter the domain name in form *[hostname].[domain]. For example, *abracadabra.com
    Do not include http:// or any other header.
  6. Click Save.
    The user-defined FQDN is shown in the table of available FQDNs, with User in the Created By column.
  7. (Optional) To display a subset of FQDNs, click Filter by Name, Path and more and select Created by or Domain.

What to do next

FQDNs can be used in context profiles for Distributed Firewall rules.