topic Re: Catchall DNS and Redirect to host in General Topics

Catchall DNS and Redirect to host

Jimbo_NGC — Tue, 23 Jan 2018 18:19:33 GMT

My old firewall was able to catch all dns requests from a zone and redirect them to a defined server. I cannot find a way to do that on the Palo Alto. Can it be done?

Re: Catchall DNS and Redirect to host

BPry — Tue, 23 Jan 2018 19:00:45 GMT

@Jimbo_NGC,

Are you talking about DNS Proxy? If yes then the firewall is perfectly able to do the same thing now. I've included a link HERE that will walk you through enabling the feature and getting it setup.

Re: Catchall DNS and Redirect to host

Jimbo_NGC — Tue, 23 Jan 2018 19:18:23 GMT

Unfortunatly not, it is more like a proxy redirect where the firewall see port 53 traffic outbound from any to any and redirects the traffic to a host that then responds. Saves a lot of time changing dns server entries in hundreds of static hosts as i migrate between firewalls or change designs. Thank you for your reply.

Re: Catchall DNS and Redirect to host

khuynh — Tue, 23 Jan 2018 23:29:01 GMT

What about doing a destination NAT policy ?

Re: Catchall DNS and Redirect to host

BPry — Wed, 24 Jan 2018 14:49:24 GMT

@Jimbo_NGC,

I would think that @khuynh's suggestion of a Destination NAT would probably work out alright. Personally I would look at using PBF to force the traffic to the destination that you prefer.

Re: Catchall DNS and Redirect to host

Jimbo_NGC — Wed, 24 Jan 2018 18:44:09 GMT

The NAT solution from any to any on 53 would not save without errors. I will look a PBF to see if it is an option. This just may be a limitation in functionality.

Thank you both for your efforts.

Jim

Re: Catchall DNS and Redirect to host

Jimbo_NGC — Wed, 24 Jan 2018 19:00:45 GMT

Putting it into other terms, I need to do a DNS sinkhole rule/nat that I can define myself on traffic between zones.