Managing Domain Name Groups

Scenario

A domain name group is a collection of domain names or wildcard domain names. (The standard format of a wildcard domain name is *.Domain_name, where * is a wildcard character that matches any character or string, for example, *.example.com.) You can reference a domain name group in an access rule to implement unified traffic control for that group. The updates of the domain name group will be automatically synchronized to all the policies associated with it. This helps you quickly modify policies and avoid repeated configuration, improving O&M efficiency.

• Adding a Domain Name Group
• Adding, Exporting, or Deleting Domain Names in a Domain Name Group
• Exporting or Deleting a Domain Name Group

Domain Name Group Types

CFW provides two types of domain name groups: application domain name groups (layer 7 protocol parsing) and network domain name groups (layer 4 protocol parsing). Table 1 describes the differences between them.

Notes and Constraints

• Adding a domain name group: Domain names in Chinese cannot be added to domain name groups.
• The constraints on the two types of domain name groups are as follows:
  • Application domain name group (layer 7 protocol parsing)
    • A firewall instance can have up to 500 domain name groups.
    • A firewall instance can have up to 2,500 domain names.
    • An application domain name group can contain up to 1,500 domain names. Up to 500 domain names can be added at a time.
  • Network domain name group (layer 4 protocol parsing)
    • A firewall instance can have up to 1,000 domain name groups.
    • A firewall instance can have up to 1,000 domain names.
    • A network domain name group can have up to 15 domain names.
    • Each domain name group can resolve up to 1,500 IP addresses.
    • Each domain name can resolve up to 1,000 IP addresses.
    • A firewall instance can contain up to 20,000 IP addresses.
• The domain name group referenced by a protection rule cannot be deleted. Modify or delete the rule first.

Adding a Domain Name Group

1. Log in to the CFW console.
2. Click in the upper left corner of the management console and select a region or project.
3. (Optional) Switch to another firewall instance. If there are multiple firewall instances, you can select a desired instance from the drop-down list in the upper left corner of the page.
4. In the navigation pane on the left, choose Protection Policies > Access Control > Object Groups.
5. Click the Domain Name Groups tab. The Application Domain Name Group subtab is displayed by default.
6. (Optional) To add a network domain name group, click the Network Domain Name Group tab.
7. On the Application Domain Name Group or Network Domain Name Group page, click Add Domain Name Group. On the Add Domain Name Group page, enter the domain name group information.

   Table 2 Domain name group parameters

   Parameter	Description
   Domain Name Group Type	Domain name group type. It can be Application or Network.
   Group Name	Name of a user-defined domain name group.
   Domain Name	Enter domain names and click Parse to add them to the domain name list. The rules are as follows: You can enter a multi-level domain name (for example, top-level domain name example.com and level-2 domain name www.example.com) or a wildcard domain name (only application domain name groups support wildcard domain names, for example, *.example.com). Multiple domain names are separated by commas (,), semicolons (;), line breaks, or spaces. Domain names must be unique.
   Description	(Optional) Enter remarks for the domain name group.

8. Confirm the information and click OK.

Adding, Exporting, or Deleting Domain Names in a Domain Name Group

1. Log in to the CFW console.
2. Click in the upper left corner of the management console and select a region or project.
3. (Optional) Switch to another firewall instance. If there are multiple firewall instances, you can select a desired instance from the drop-down list in the upper left corner of the page.
4. In the navigation pane on the left, choose Protection Policies > Access Control > Object Groups.
5. Click the Domain Name Groups tab. The Application Domain Name Group subtab is displayed by default.
6. (Optional) To add, export, or delete a network domain name group, click the Network Domain Name Group tab.
7. Click the name of the target domain name group. The Domain Name Group Details page is displayed.
8. Add, export, or delete domain names in a domain name group.

   Table 3 Adding, exporting, or deleting domain names in a domain name group

   Operation	Procedure
   Adding a domain name to a domain name group	Click Add Domain and enter domain name information. You can click Add to add multiple domain names. Confirm the information and click OK.
   Exporting domain names in a domain name group	On the domain name group details page, click Export above the list and select the data scope. Data will be automatically exported to your local PC.
   Deleting domain names in a domain name group	On the domain name group details page, locate the row that contains the target domain name and click Delete in the Operation column. To delete multiple domain names, select the target domain names and click Delete above the list. In the displayed dialog box, confirm the information and click OK.

Exporting or Deleting a Domain Name Group

Deleted domain names cannot be restored. Exercise caution when performing this operation.

1. Log in to the CFW console.
2. Click in the upper left corner of the management console and select a region or project.
3. (Optional) Switch to another firewall instance. If there are multiple firewall instances, you can select a desired instance from the drop-down list in the upper left corner of the page.
4. In the navigation pane on the left, choose Protection Policies > Access Control > Object Groups.
5. Click the Domain Name Groups tab. The Application Domain Name Group subtab is displayed by default.

   (Optional) To export or delete a network domain name group, click the Network Domain Name Group tab.

6. Export or delete a domain name group.
   • Export a domain name group:

     Click Export above the domain name group list and select the data scope. The system automatically exports the data to your local PC.

   • Delete a domain name group:
     1. Locate the row that contains the target domain group and click Delete in the Operation column.

        To delete multiple domain name groups, select the target domain name groups and click Delete above the list.

     2. In the displayed dialog box, enter DELETE and click OK.

Related Operations

• Managing domain name groups:
  • Exporting domain name groups: Click Export above the list and select a data range.
  • Editing a domain name group: Click the name of a domain name group and modify parameters.
• Managing domain names in domain name groups:

  Batch deleting domain names: On the domain name group details page, select domain names, click Delete above the list, confirm the information, and click OK.

• A domain name group takes effect only after it is set in a protection rule. For more information, see Configuring Protection Rules to Block or Allow Internet Border Traffic.
• Viewing the IP addresses resolved by a domain name group of the network domain name group type: Click a domain name group name to go to the Basic Information page, and click IP address in the Operation column of the domain name list.