How to test DNS Security Properly?

bspilde — Mon, 24 Jun 2019 21:01:47 GMT

In reading up on DNS Security I found that URL's provided for testing in the following document, Enabling DNS Security, do not accurately ensure DNS Security feature license is installed and configured. A very accurate indicator of this is that all of those URL's are adequately blocked on a firewall running PAN-OS 8.1.x due to the PAN-DB URL filtering policies most companies would have enabled.

Here is the suggested testing method from the above URL:

Test that the policy action is enforced.
1. Access the following test domains to verify that the policy action for a given threat type is being enforced:
  - Malware—test-malware.testpanw.com
  - C2—test-c2.testpanw.com
  - DGA—test-dga.testpanw.com
  - DNS Tunneling—test-dnstun.testpanw.com

So this leads me to the questions...

How DO you accurately test that DNS Security is blocking DGA, DNS Tunneling, etc.?
Can the Administrator Guide please be updated to accurately describe the process ensuring proper enablement of the DNS Security advanced feature?

BTW, @PANW - Why is the Oilrig signature default action "alert" instead of blocking it? Using a strict profile is pretty essential.

If you have a successful test plan for DNS Security implementation please comment.

Thanks!

Re: How to test DNS Security Properly?

S.Cantwell — Fri, 28 Jun 2019 19:35:24 GMT

The steps provided were to show you that the DNS Sinkhole functionality was being actioned/"hit on".

While I agree that these same sites are probably used in the Content Profile for URL Categorization, testing was done to provide confirmation that DNS sinkhole was working.

I enabled the Spyware profile to use the licensed DNS security feature.

But, instead of using the default sinkhole.paloaltonetworks.com FQDN, I used a bogus 9.9.9.9 as my sinkhole.

Then I tested the 4 sites.

My traffic was blocked, not because of the URL. In looking at the threat logs, I see the action of sinkhole against the IP of my device.

For confirmation, I filtered on the Traffic log, and saw 4 hits on a destination IP of 9.9.9.9, which were not there, prior to my testing.

Therefore, the DNS Security feature, along with sinkholing to a different IP, shows/provides me confidence that the DNS security feature worked, before the URL filtering profile (which may well have those 4 sites listed), but Spyware profile is what was triggered.

Thank you.

topic How to test DNS Security Properly? in Advanced Threat Prevention Discussions

How to test DNS Security Properly?

Re: How to test DNS Security Properly?