A third-party protection-relay vendor provides remote support to a substation device from a cloud-hosted jump host whose public IP address changes periodically because the vendor uses a dynamic-DNS provider. The utility wants a firewall policy that keeps working automatically as the vendor's IP changes, without a scheduled task to update the policy. Which address-object type is designed for this in FortiOS 7.6?
Select an answer to reveal the explanation.
Short Explanation
Think of an FQDN address object as the firewall doing its own DNS lookups behind the scenes — give it the vendor's hostname once, and it keeps re-resolving that name so the policy tracks the vendor's changing IP without anyone touching the config.
Full Explanation
FortiOS supports an FQDN-type address object that stores a hostname rather than a fixed IP; the FortiGate periodically resolves that name via DNS and updates the underlying IP set used for policy matching automatically, which is exactly the behavior needed when a partner's address changes on its own schedule through dynamic DNS. A static IP/netmask object solves the problem only until the vendor's address rotates again, reintroducing the same manual-update burden the utility is trying to eliminate. A geography-based object is matched against FortiGuard's IP-to-country database, not against a specific host, so it would let in the vendor's current address only by accident, while also permitting every other address FortiGuard maps to that country, a large, uncontrolled increase in exposure to a substation device. An IP-range object covering the vendor's whole ISP allocation has the same problem in miniature: it is far broader than the one jump host that actually needs access, and it still has to be re-verified whenever the ISP's allocation changes. The FQDN approach keeps the trust boundary tied to something the vendor actually controls and publishes, their own hostname, rather than to network-layer detail that shifts underneath the utility. Operationally, the FortiGate's address-object detail view will show the addresses currently resolved for the FQDN object, letting an engineer confirm it is tracking the vendor's current IP.