topic Re: DNS sinkhole v9.0.1 in Advanced Threat Prevention Discussions

DNS sinkhole v9.0.1

ash83 — Thu, 11 Apr 2019 18:53:47 GMT

Have 2 HA VMs with 9.0.1

Following this article: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/threat-prevention/use-dns-queries-to-identify-infected-hosts-on-the-network/identify-infected-hosts.html

In section 3), how does this need to be configured ((addr.dst in 10.15.0.20) ) when using Palo Alto Networks Sinkhole IP (sinkhole.paloaltonetworks.com) ?

Thanks.

Re: DNS sinkhole v9.0.1

OtakarKlier — Thu, 11 Apr 2019 20:07:24 GMT

Hello,

Its whatever you configured in your anti-spyware policies.

Regards,

Re: DNS sinkhole v9.0.1

ash83 — Fri, 12 Apr 2019 08:05:22 GMT

Hello,

From https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/threat-prevention/use-dns-queries-to-identify-infected-hosts-on-the-network/configure-dns-sinkholing.html

The IP addresses currently are IPv4—sinkhole.paloaltonetworks.com and a loopback address IPv6 address—::1. These address are subject to change and can be updated with content updates.

As per my previous update, in PAN-OS v9.0.1:

Re: DNS sinkhole v9.0.1

MP18 — Mon, 17 Jun 2019 20:24:59 GMT

just use the configured IPV4 dns address

Re: DNS sinkhole v9.0.1

Velo-JV — Fri, 10 Apr 2020 16:32:49 GMT

The only options available are the loopback or the PAN URL:

There is no IPV4 available for the PAN networks.

Re: DNS sinkhole v9.0.1

reaper — Fri, 10 Apr 2020 16:37:31 GMT

@Velo-JV in the drop-down, yes

Just type a different IP 🙂

Re: DNS sinkhole v9.0.1

Velo-JV — Fri, 10 Apr 2020 16:59:45 GMT

Ahh ok got it. Is there a list of available sinkhole IPs that Palo Alto hosts? I am following along their guide "See Infected Hosts that Attempted to Connect to a Malicious Domain" and the report you create needs you to specify a specific IP destination, which has gone away in 9.0.

Thank you,

Jonathan

Re: DNS sinkhole v9.0.1

reaper — Fri, 10 Apr 2020 17:02:33 GMT

The panw hosted one is sinkhole.paloaltonetworks.com, by you can use any IP, preferably something that's not on the internet and not in your network either (unless you have a Honeypot)

Re: DNS sinkhole v9.0.1

Velo-JV — Fri, 10 Apr 2020 17:03:10 GMT

Got it sounds good. Thanks for the quick response.