topic Submitting DNS block without blocking the IP in Custom Signatures

Submitting DNS block without blocking the IP

dlevenden — Fri, 03 Mar 2017 18:11:13 GMT

I'm looking to submit a FQDN block where I don't ever block the IP.

I've reviewed this article on blocking FQDN's but can't seem to figure out how to ignore the IP. We assign fake ip addresses to known malicius sites, and need the HTTP, HTTPS, SSH, etc traffic to route back to us, but the block on the FQDN is also blocking the IP once the lookup is processed.

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-and-Test-FQDN-Objects/ta-p/61903

Any suggestions?

Thanks.

Re: Submitting DNS block without blocking the IP

BenjAudy.MTL — Mon, 06 Mar 2017 20:57:45 GMT

I'm not sure I understand your problem. You mean you have a blocking rule with the FQDN as the destination address? If you want to reroute the traffic to some identified malicious websites, why do you have a blocking rule in the first place?

Benjamin

Re: Submitting DNS block without blocking the IP

dlevenden — Tue, 07 Mar 2017 21:22:09 GMT

great question. We offer a service to a customer that blocks on a paloAlto system at their end, which we're fine with them blocking the FQDN, but we need to not block the IP at the same time to allow other traffic to make it through if the name/domain isn't blocked on the customer side.

Thanks.

Re: Submitting DNS block without blocking the IP

mivaldi — Wed, 10 May 2017 17:24:43 GMT

Check dns-req-section in page 19 of this document:

Creating Custom Application and Threat Signatures

There's an example for FQDN www.thebayareagamers.com

You can also add an EDL of type "Domain" and point it to a web-server that contains the list of domains you want to block.

See: https://live.paloaltonetworks.com/t5/tkb/articleprintpage/tkb-id/PANOS71Articles/article-id/10