topic PAN as a DNS Forwarder to resolve External DNS Names in General Topics

PAN as a DNS Forwarder to resolve External DNS Names

ErwinBuena — Tue, 15 Jul 2014 04:03:32 GMT

I'm looking on how to configure DNS proxy on PAN and found below link that provide great information.

https://live.paloaltonetworks.com/docs/DOC-3637

https://live.paloaltonetworks.com/docs/DOC-3522

https://live.paloaltonetworks.com/docs/DOC-4633

However, it does not cover the design that I want for DNS resolution and protect our internal DNS servers.

- I would like to check if anyone has done configuring their internal DNS server to use PAN (DNS Proxy configuration) as a DNS forwarder to resolved all external DNS??

- PAN DNS Proxy will have entry for public DNS server coming from our local ISP server provider at the same time PAN firewall is configured to forward DNS resolution bound for our local domain resolution

- Using the above setup, I can protect my internal DNS since all external DNS resolution will be coming from PAN Firewall.

Any information or ideas are highly appreciated

Cheers,

Erwin

Re: PAN as a DNS Forwarder to resolve External DNS Names

HULK — Tue, 15 Jul 2014 06:10:48 GMT

Few related discussions for your reference:

DNS Proxy -- https://live.paloaltonetworks.com/thread/8699

DNS Proxy -- https://live.paloaltonetworks.com/thread/6767

DNS proxy

Thanks

Re: PAN as a DNS Forwarder to resolve External DNS Names

ErwinBuena — Tue, 15 Jul 2014 09:03:55 GMT

Thanks Hulk for the feedback

Re: PAN as a DNS Forwarder to resolve External DNS Names

mivaldi — Tue, 15 Jul 2014 22:47:24 GMT

You can configure your DHCP to tell your clients to have the internal interface of the firewall as their DNS. Then use DNS Proxy to handle the DNS resolution. You can also deploy a security policy to Deny all dns requests going to the outside (from anyone except the firewall), and only let users resolve DNS if they use your firewall's trust interface.

Re: PAN as a DNS Forwarder to resolve External DNS Names

ErwinBuena — Tue, 15 Jul 2014 23:14:23 GMT

Hi Mivaldi,

Thanks for the information. Deploying the PAN internal Interface as the DNS for all DHCP client will not scale out and it's adds up additional time for DNS resolution for internal networks.

Reading all the discussion about DNS forwarding in this forum provide me great information including the one that you mention.

1. I've decided to configure our internal DNS server to have a DNS forwarder point to PAN Internal Network for Internet (external) DNS Resolution and query data to our ISP Public DNS.

2. External DNS will only communicating for all DNS resolution via PAN DNS Proxy.

Cheers,

Erwin