topic Re: URL Filtering and DNS in General Topics

URL Filtering and DNS

susan_collins — Thu, 14 Mar 2013 19:55:43 GMT

Hi,

I'm trying to figure out if the URL Filtering detects domians in DNS requests and can take actions based on a domain in a DNS request (ie. blocking). I would like to move some of my DNS sinkhole activity to the Palo Alto 5020, but i'm unsure if this is a viable option with URL filtering.

Thanks in advance!

-sc

Re: URL Filtering and DNS

rmonvon — Thu, 14 Mar 2013 20:58:15 GMT

Hi...URL Filtering is applied to web browsing traffic and not to DNS requests. In PAN-OS 5.x, DNS botnet signatures are supported as part of the threat prevention license. Thanks.

Re: URL Filtering and DNS

susan_collins — Thu, 14 Mar 2013 21:52:31 GMT

Thanks Rmonvon,

Do you know if DNS sinkholing can be implemented on the Palos? Thanks!

-sc

Re: URL Filtering and DNS

mikand — Fri, 15 Mar 2013 07:47:52 GMT

As already mentioned the URL filtering is based on the the contents of the actual http request.

However in PA there is also a DNS-proxy feature which I think might be able to be used to sinkhole various domains, see some info in

The admin guide has a better description regarding settings of the dns-proxy feature.

In my opinion the best option is to use your own dns-servers (place in DMZ) and perform the sinkholing in them.