topic Re: DNS Sinkhole not triggering for known malicious domains in General Topics

DNS Sinkhole not triggering for known malicious domains

Smi12 — Thu, 25 Feb 2016 16:25:43 GMT

Hello, has anyone had any problems with DNS sinkhole not triggering on PAN-OS 6.1.4 ?

I have created a security policy for DNS traffic between a LAN side DNS server and a WAN side upstream DNS server, the Palo sits at the WAN edge between the two DNS servers. Attached to this security policy is an Anti-spyware security policy with DNS action alert. This works as expected, alerting every time a query for a known malicious domain is seen, so no problem seeing the traffic albeit with the LAN side DNS server as the source IP address.

So with a duplicate (higher) security rule and spyware policy now set to sinkhole, the traffic is seen as "DNS" by this new rule but does not trigger the treat and so does not receive the sinkhole IP address I have set.

Any help would be greatly appreciated.

Re: DNS Sinkhole not triggering for known malicious domains

pankaku — Thu, 25 Feb 2016 18:10:37 GMT

Check out this doc it will surely help if the dns sinkhole is configured properly.

https://live.paloaltonetworks.com/t5/Threat-Articles/Where-to-Get-a-Suspicious-DNS-Query-for-Testing-DNS-Sinkhole/ta-p/66048

Re: DNS Sinkhole not triggering for known malicious domains

pankaku — Thu, 25 Feb 2016 18:12:04 GMT

Make sure that the antivirus update are consecutive. Highest and second highest

Re: DNS Sinkhole not triggering for known malicious domains

Brandon_Wertz — Thu, 25 Feb 2016 18:12:20 GMT

So you've got an Anti-Spyware policy set up like this:

With no logs in threat that look like this?

Do you have any "Traffic" logs of hosts going to your sinkhole IP?

Re: DNS Sinkhole not triggering for known malicious domains

Smi12 — Mon, 29 Feb 2016 09:40:01 GMT

Thanks for the response, for further info as of today we are running AV 1797-2276 and I have performed further tests.

My sinkhole spyware profile is configured like this:

I then attempt to lookup a known malicious domain. In the traffic logs I can see that my test traffic hits the correct security rule that should apply the dns sinkhole IP address. However it does not sinkhole the traffic and does not trigger a threat log for spyware domain.

Using packet capture I can see that my query contains the known malicious domain as below:

Does anyone have any further thoughts that may help please?

Re: DNS Sinkhole not triggering for known malicious domains

pankaku — Mon, 29 Feb 2016 13:21:56 GMT

If you will check the url cateogry as malicious then it will/may not trigger the sinkhole. Check the link that I have sent you follow it once just for testing.

https://live.paloaltonetworks.com/t5/Threat-Articles/Where-to-Get-a-Suspicious-DNS-Query-for-Testing-DNS-Sinkhole/ta-p/66048

download and install antivirus 1797-2276 and do the dns lookup for "d1e9me*d3jmum*com" replace * with .

Re: DNS Sinkhole not triggering for known malicious domains

glastra1 — Thu, 03 Mar 2016 04:12:13 GMT

Not sure how the client is trying to connect to the sinkhole IP addres if it's receiving an error code in the DNS response instead of the sinkhole IP address (unless the packet capture is missing something). By any chance is the client using an internal DNS server?

From RFC 1035 (DNS) the response "no such name"

                3               Name Error - Meaningful only for
                                responses from an authoritative name
                                server, this code signifies that the
                                domain name referenced in the query does
                                not exist.

Re: DNS Sinkhole not triggering for known malicious domains

santonic — Thu, 03 Mar 2016 07:56:55 GMT

Yeah, check who is sending those 'no such name' responses. That can't be PA.

Re: DNS Sinkhole not triggering for known malicious domains

Smi12 — Fri, 04 Mar 2016 08:58:20 GMT

Hello, it is the remote DNS server sending the "no such name" response. However what I was expecting is that for the reason the lookup contains a known malware domain it would trigger the PA to respond with the Sinkhole IP instead. Instead its not seen as Malware so does not trigger the sinkhole. I'm going to be spending some time next week looking at this again and will update.