topic Re: DNS Security in Advanced Threat Prevention Discussions

DNS Security

lcelinski — Mon, 15 Apr 2019 14:13:54 GMT

Hello,

Is there any way to turn off the following information after commit on 9.0.1 with Anti-Spyware Profile attached to Security Policy?

I can't delete Palo Alto Networks DNS Security option from Anti-Spyware Profile.

Warnings

Warning: No Valid DNS Security License
(Module: device)

Lukasz

Re: DNS Security

Retired Member — Mon, 13 May 2019 08:42:48 GMT

Try delete it from CLI:

delete profiles spyware XXXXX botnet-domains lists default-paloalto-cloud

Re: DNS Security

lcelinski — Mon, 13 May 2019 09:36:15 GMT

I opened a case and it was escalated developers

Re: DNS Security

aritzposada — Wed, 29 May 2019 13:56:53 GMT

Thank you, this works for me.

You can't delete it from the default anti-spyware profiles, so if you are using them the warning will appear everytime you commit.

I cloned both of them (default and strict). Then I delete that "default-paloalto-cloud" entry from these new profiles and to finish I ensured to change the defaults with the new ones in all the Profiles Groups, Security Policies, etc...

Re: DNS Security

lcelinski — Wed, 29 May 2019 14:17:39 GMT

I got the confirmation from Engineering that it is expected not to be able to delete default DNS options from GUI. You can use CLI. Fix for the warnings during commit is targeted to be released on 9.0.4

Re: DNS Security

rmarlow — Thu, 06 Jun 2019 10:14:20 GMT

I am trying to do this in Panoramma using the following command but get an error. The profile I am trying to delete it from is one I created and not a predefined one.

delete device-group [device-group] profiles spyware [spyware-profile] botnet-domains lists default-paloalto-cloud

No object to delete in delete handler

Re: DNS Security

aritzposada — Thu, 06 Jun 2019 10:30:12 GMT

Hi Rmarlow,

Is it possible that this object is in use? Or maybe shared?
Try cloning this object and deleting the profile "default-paloalto-cloud". If this works, it may be because the original object is referenced.

Re: DNS Security

rmarlow — Thu, 06 Jun 2019 10:40:34 GMT

Thanks for the quick response.

Looking at it again this profile was located in shared so I needed to use the following.

delete shared profiles spyware [spyware-profile] botnet-domains lists default-paloalto-cloud

Many Thanks

Re: DNS Security

HemanthV — Tue, 30 Jul 2019 07:04:22 GMT

Hi Team

is it possible to share the command to delete the Antispyware profile

Re: DNS Security

jesseivens — Tue, 13 Jul 2021 19:30:22 GMT

I ran into this issue when I upgraded some VM-500s to 10.0.6. I was able to clone the default spyware profile, which I named "default-no-dns-sec" Then I went into CLI and issued the following commands to delete DNS specific items.

delete shared profiles spyware default-no-dns-sec botnet-domains lists default-paloalto-dns
delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-cc
delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-ddns
delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-grayware
delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-malware
delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-parked
delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-phishing
delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-proxy
delete shared profiles spyware default-no-dns-sec botnet-domains dns-security-categories pan-dns-sec-recent

On this firewall I have not "production" traffic yet, so I was able to disable all policies. I enabled 1 with this new profile and pushed from Panorama. No issues with the commit and no more warning. All policies and/or Security Profile Groups will need to be updated to completely solve this.

I do have a TAC case open, so I am waiting for confirmation from TAC on this.

Re: DNS Security

Kryptonite — Thu, 09 Sep 2021 10:06:08 GMT

I think deleting the AntiSpyWare profile wouldn't be a great move. That will decrease your visibility. Try allowing an exception using the ID. You can do this from the Threat Monitor.

Re: DNS Security

jesseivens — Thu, 09 Sep 2021 12:09:47 GMT

My comment above is only deleting the dns-sec from the profile, not removing the whole AntiSpyWare profile. I am still using all the other functions of the AntiSpyWare profile. Also my solution was confirmed to by TAC for a work around.