topic Re: DNS over TLS in 10.2.4 in General Topics

DNS over TLS in 10.2.4

nevolex — Mon, 10 Apr 2023 01:40:04 GMT

Hi All

it seems like late last year DNS over TLS feature has been added to Palo Alto firewalls

However I am having issues understanding where it needs to be configured, I did read the guides but still unclear

So my external dns is 1.1.1.1 and I use DNZ proxy, 1.1.1.1 does support dns over tls but for that a domain needs to be configured instead of the ip

https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-tls/

the dns proxy does not allow fqdns to be configured only ips....

I also have default dns security applied to a policy (per the guide it needs to "inspect traffic") but I don't know what that actually means (is that what packet capture is in there per dns category???)

I also created a description policy for tcp 853 - no hits there

in the logs the firewall sends all the dns traffic over port 53, nothing goes over 853

on a FortiGate it was very clear how this is set, but I am scratching my head how it's done on a palo alto

please advise?

thank you

Re: DNS over TLS in 10.2.4

nevolex — Wed, 12 Apr 2023 07:44:16 GMT

Ok, it looks like that Palo alto does not support that neither, that dns over tls support from the manual is for decryption purposes only in case if clients send traffic over tls, however what I mean is tls traffic dns forwarding, where the clients send the traffic via normal port 53, then the firewall sends that traffic over 853 to the external dns server like 1.1.1.1 for domain resolution

It looks Palo alto DNS Proxy app does not support secure dns at all:(

Re: DNS over TLS in 10.2.4

kiwi — Tue, 11 Apr 2023 12:17:28 GMT

Hi @nevolex ,

I was unable to find an existing feature request for it either.

You could ask your local SE to file a feature request for it after which you and everyone else can add their vote to it.

Kind regards,

-Kiwi.