topic Re: FQDN rules and DNS features in General Topics

FQDN rules and DNS features

bdaussin — Tue, 17 May 2011 04:23:28 GMT

Hi all,

We started using FQDN rules few days ago. The purpose, once again, is to remove "basic IP rules" and to allow the team in charge of server to move their application without asking to change Firewall rules all the time. So, it works great but we have some limitations. Because the PAN device takes into account the TTL value, it will send DNS request every TTL value. On the PAN device, we can ask to force the refresh every 4 hours, but no less. 4 hours is quite a long time.....

To make the behaviour more dynamic and because PAN devices are "application aware" firewalls, it should be possible to inspect DNS traffic running from the clients to the DNS servers. The idea here would be to inspect responses from the internal DNS ( trusted ) and make the PAN devices update their DNS table with these informations.

I would like to get your feed back about this proposal.

Thanks you.

Re: FQDN rules and DNS features

bdaussin — Thu, 19 May 2011 04:38:35 GMT

someone ?

Re: FQDN rules and DNS features

bpappas — Thu, 19 May 2011 14:06:20 GMT

This would be a feature request and should be directed to your sales team so that they may submit it on your behalf.

-Benjamin

Re: FQDN rules and DNS features

bdaussin — Thu, 19 May 2011 14:23:08 GMT

Thanks,

I've already sent the feature request to our sales teams. Here I just want to have Palo Alto and other customer's feedback about the usefullness and security aspects of the feature.

Benjamin