topic Re: dns sinkhole rule in Advanced Threat Prevention Discussions

dns sinkhole rule

Jose_Espinoza — Fri, 13 Oct 2023 17:37:26 GMT

hi all

we are in a dilemma, we have enable dns sinkhole in our anti-spyware profile enable:

dns sinkhole > DNS Policies > default-paloalto-dns > sinkhole enable .

DNS Sinkhole Setting> IPv4 > X.X.X.X

Now, this profile is also added to our security profiles used in all rules , means we have all rules with a DNS policy.

our main concern is: Do we need a specific rule at the top of all rules specific for DNS sinkhole? yes or no?

thanks all for the possible feedback about it.

jose

Re: dns sinkhole rule

Raido_Rattameister — Sat, 14 Oct 2023 23:18:59 GMT

You don't need dedicated rule for that traffic. If you leave it to default traffic goes to Palo Alto IP and utilizes your default outgoing traffic policy. If you need to run reports of machines connected to that IP you can use sinkhole IP in report filter so dedicated policy would not give much value.

Re: dns sinkhole rule

Jose_Espinoza — Mon, 16 Oct 2023 18:10:35 GMT

hello there

Thank you for the replay, I have the same thoughts for this.

I will work on clean up the rules from fw's .

thank you again

jose