EDL Dynamic Domain list that is allowed in Anti-spyware profile> DNS Polices is getting sinkholed

Dereje — Fri, 19 Jan 2024 15:17:23 GMT

We have four VM 300 firewalls configured as DNS proxy with DNS Security, where all our users (around 65K) are using them as a DNS resolver. The pano os version we are running is 10.1.11-h4.

We have configured couple of EDL custom domain list, one to allow domains otherwise blocked by PA's DNS signature and one to block domains that our security finds vulnerable. These EDLs are configured through Anti-spyware profile > DNS Policies > for Allow EDL policy action Alert, and for Block EDL policy action sinkhole.

Since yesterday, we start seeing that all domains in the Allowed list are getting sinkholed and we see under Monitor > Threats that these domains are blocked by the Blocked EDL.

We have been working with the TAC since yesterday, and it seems no luck on that.

Thank you

Re: EDL Dynamic Domain list that is allowed in Anti-spyware profile> DNS Polices is getting sinkholed

Nicholas185Smith — Wed, 28 Feb 2024 03:43:32 GMT

@Dereje BallSportsGear @Dereje wrote:

We have four VM 300 firewalls configured as DNS proxy with DNS Security, where all our users (around 65K) are using them as a DNS resolver. The pano os version we are running is 10.1.11-h4.

We have configured couple of EDL custom domain list, one to allow domains otherwise blocked by PA's DNS signature and one to block domains that our security finds vulnerable. These EDLs are configured through Anti-spyware profile > DNS Policies > for Allow EDL policy action Alert, and for Block EDL policy action sinkhole.

Since yesterday, we start seeing that all domains in the Allowed list are getting sinkholed and we see under Monitor > Threats that these domains are blocked by the Blocked EDL.

We have been working with the TAC since yesterday, and it seems no luck on that.

Thank you

Hello,

It seems that you are experiencing a known issue with the DNS Security feature in PAN-OS 10.1.11-h4. According to the Palo Alto Networks Knowledge Base, there is a bug that causes the DNS Security to incorrectly sinkhole domains that are in the allow list of the DNS policy. This bug affects the VM-Series firewalls that are configured as DNS proxies and use external dynamic lists (EDLs) of type domain in the DNS policy.

The workaround for this issue is downgrade the PAN - OS version 10.1,10 or earlier or to upgrade to 10.1.12 or later, which have fixed this bug. Alternatively, you can disable the DNS Security feature on the VM-Series firewalls until you can upgrade or downgrade the PAN-OS version.

I hope this helps to understand and resolve the issue.

Best regards,

Nicholas185Smith

topic EDL Dynamic Domain list that is allowed in Anti-spyware profile> DNS Polices is getting sinkholed in Advanced Threat Prevention Discussions

EDL Dynamic Domain list that is allowed in Anti-spyware profile> DNS Polices is getting sinkholed

Re: EDL Dynamic Domain list that is allowed in Anti-spyware profile> DNS Polices is getting sinkholed