Unable to resolve internal url's after implementing dns security.

OsamaKhan — Mon, 31 Aug 2020 10:15:24 GMT

I only would like to know if we add *.domain.in in External dynamic list and if we call that EDL in Antispyware profile with action Alert, then EDL will take preference with alert action and exclude it or DNS security will take preference with sinkhole action.

Re: Unable to resolve internal url's after implementing dns security.

mivaldi — Wed, 16 Sep 2020 21:52:40 GMT

No, you need to whitelist the domain in the DNS Security local cache.

If you ran PAN-OS 10.0 you can configure domain exceptions in the Anti-Spyware profile, but for 9.0 and 9.1 the exception is global and you need to configure it from the CLI.

I added instructions in this post https://live.paloaltonetworks.com/t5/general-topics/disney-domain-being-sinkholed-as-dns-tunneling-domain/m-p/325813

It would be best to investigate why your internal domain is considered malicious though. It could be an FP and could be whitelisted in the cloud.

You can try to see if the domain is listed as a malicious URL Category in https://urlfiltering.paloaltonetworks.com/query/ and if it is, request a category change to an otherwise benign category. That will propagate a signal from PAN-DB to DNS Security to also whitelist the domain.

topic Re: Unable to resolve internal url's after implementing dns security. in Advanced Threat Prevention Discussions

Unable to resolve internal url's after implementing dns security.

Re: Unable to resolve internal url's after implementing dns security.