URI/FQDN DFW is not working

Products

• VMware NSX
• VMware vDefend Firewall

Issue/Introduction

• Some websites, like Youtube.com for example, do not load completely when added in explicit allow and deny all DFW configuration.
• With websites where there is a dependency on multiple domains for the page to load fully face issues when used in URI DFW as explicit allow.
• For example :

Youtube.com : dependency on multiple domains (*youtube.com || *.googleapis.com || *.googlevideo.com || *ytimg.com etc)

DFW config allowing ONLY youtube.com
0: any any allow DNS
1: any any allow www.youtube.com
2: any any block

Environment

VMware NSX

VMware NSX-T Data Center

Resolution

This is a condition that may occur in a VMware NSX environment.

Workaround:

NSX is working as expected to allow youtube.com and block the rest of the domains. In order to load the website fully, all the dependent domains/subdomains are also required to be allowed in DFW configuration before the "deny all" rule.
Use the Network option in developer tool to gather details of the domain where there is dependency and allow them in the DFW policy.
Create an explicit allow DFW FQDN based rule for website with multiple dependencies

Additional Information