topic Re: DNS Sinkhole in Advanced Threat Prevention Discussions

DNS Sinkhole

Doyenadmin — Wed, 13 Jul 2022 16:23:59 GMT

Hi guys,

I have Threat prevention license in my PA-3200 Series firewall but when i configure dns sinkhole in antispyware I am getting Warning: "No Valid DNS Security License" during commit, do i need to buy DNS license to work with sinkhole feature.

Please suggest.

Re: DNS Sinkhole

PavelK — Wed, 13 Jul 2022 22:02:53 GMT

Hello @Doyenadmin

for DNS Sinkhole setup, the DNS Security License is not required. The Threat Prevention License is enough to enable this feature.

Could you please share a screen of your setup along with PAN-OS version?

I would also recommend to have a look into this KB to make sure that it is configured according to best practice: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGECA0

Kind Regards

Pavel

Re: DNS Sinkhole

aleksandar.astardzhiev — Thu, 14 Jul 2022 08:37:08 GMT

Hi @Doyenadmin

Just to add to @PavelK great answer it is important to point which DNS signature policy you have configured with sinkhole.

As you can see from the documentation "DNS Security" category requires the additional DNS Security license

Trying to use any of the above with action sinkhole or block will require additional license. And this is how it looks on 9.1 versions

Re: DNS Sinkhole

Doyenadmin — Thu, 14 Jul 2022 15:05:38 GMT

Hi Pavel,

Pan-os version is 10.1.5-h2, and as per KB article if i'll use Paloalto Networks content signatures and action as sinkhole - i won't require DNS signature license.

and if i will go for DNS security signature, ill be requiring DNS license.

correct me if i am wrong.

Re: DNS Sinkhole

PavelK — Fri, 15 Jul 2022 12:36:16 GMT

Thank you for reply @Doyenadmin, your understanding is correct.