topic Custom DNS name in General Topics

Custom DNS name

jdprovine — Tue, 14 Jun 2016 15:11:11 GMT

We have a DNS name genieo that is not being recognized and is not included in the signatures. Two things first is there a way to identify it with a custome signature with the object/anti-spyware and then be able to send it to a sinkhole?

Re: Custom DNS name

Raido_Rattameister — Tue, 14 Jun 2016 16:20:31 GMT

You could:

- use custom URL category and block this traffic

- use DNS Proxy and fake some random (localhost) ip as answer

- if running 7.1 use Dynamic Lists with type URL to create custom url categories and block in the policy

Re: Custom DNS name

jdprovine — Wed, 15 Jun 2016 14:38:50 GMT

Do you have to have the URL filtering subscription to do these two?

- use custom url category and block this traffic

- if running 7.1 use the Dynamic Lists with the URL to create custom url categories and block the policy

Re: Custom DNS name

Raido_Rattameister — Wed, 15 Jun 2016 15:13:57 GMT

Re: Custom DNS name

jdprovine — Wed, 15 Jun 2016 16:06:32 GMT

Good I will check it out

Re: Custom DNS name

jdprovine — Wed, 15 Jun 2016 16:54:34 GMT

I don't see options to sinkhole these only to block etc. My manager wants to be able to sinkhole.

Re: Custom DNS name

BPry — Wed, 15 Jun 2016 17:55:47 GMT

jprovine,

If you look at the following I'm fairly certain that you can accomplish this fairly easily with anti-spyware filtering.

Re: Custom DNS name

jdprovine — Wed, 15 Jun 2016 18:09:31 GMT

Good suggestion but I tried that but I didn't see a way to sinkhole it only to block or reset just the basic but no sinkhole option than I can find, if you want give me the instruction maybe I missing it

Re: Custom DNS name

jdprovine — Wed, 15 Jun 2016 18:10:03 GMT

Good suggestion but I tried that and I didn't see a way to sinkhole it, only to block or reset just the basic but no sinkhole option than I can find, if you want give me the instruction maybe I missing it

Re: Custom DNS name

Raido_Rattameister — Wed, 15 Jun 2016 18:53:16 GMT

You have to run 7.1 to include your custom url lists into sinkhole.

With 7.0 or below you have to use DNS Proxy and use this to send back fake DNS replies back.

Re: Custom DNS name

jdprovine — Wed, 15 Jun 2016 19:08:37 GMT

Good information I am currently on 6.1.11 so that is not a option for me at this point