topic Re: Configuring DNS sink hole on PA 3050 running PAN-OS 7.1.18 in General Topics

Configuring DNS sink hole on PA 3050 running PAN-OS 7.1.18

seanmccoy — Fri, 16 Nov 2018 18:47:35 GMT

I need assistance configuring/verifying if DNS Sinkholing is correct on my PA3020 running PAN-OS 7.1.18.

Re: Configuring DNS sink hole on PA 3050 running PAN-OS 7.1.18

BPry — Fri, 16 Nov 2018 20:03:37 GMT

@seanmccoy,

Here's the knowledgbase article for it HERE, if you have any specific questions please let us know.

Re: Configuring DNS sink hole on PA 3050 running PAN-OS 7.1.18

seanmccoy — Fri, 16 Nov 2018 20:55:54 GMT

This is what I see when I choose Palo Alto Networks Sinkhole IP from the drop down

Re: Configuring DNS sink hole on PA 3050 running PAN-OS 7.1.18

BPry — Fri, 16 Nov 2018 21:22:40 GMT

@seanmccoy,

Okay so outside of a few customizations it looks like you already have it configured and the IP of the default Palo Alto sinkhole IP is just failing to load. At the bottom of that query is a link to a verification document on how you would verify things are properly sinholing, but you should effectively be getting the response of 72.5.65.111 if you attempt to lookup a host that matches one of the DNS Signatures that are published.

Re: Configuring DNS sink hole on PA 3050 running PAN-OS 7.1.18

seanmccoy — Fri, 16 Nov 2018 21:55:52 GMT

So I followed step 4 of the query and created the security rule with the Palo Alto Default sinkhole address (72.5.65.111) as the destination and moved it to the top. If I look at threat logs I still see my internal DNS servers IP addresses if I filter by app eq sinkhole.

Re: Configuring DNS sink hole on PA 3050 running PAN-OS 7.1.18

seanmccoy — Fri, 16 Nov 2018 21:59:05 GMT

Anywhere I can verify that Palo Alto sinkhole IP object on the firewall?

Re: Configuring DNS sink hole on PA 3050 running PAN-OS 7.1.18

BPry — Fri, 16 Nov 2018 22:34:09 GMT

@seanmccoy,

There really isn't a way to verify the object easily on the firewall, you have to get involved with the XML files that actually make up the device and peek around in the tech support file. If you look at the traffic logs for the sinkhole IP do you see any activity, and have you verified that you've setup logging on the rule you created to deny the traffic?

I wouldn't filter on the sinkhole app-id, that's kind of a bad test.

Re: Configuring DNS sink hole on PA 3050 running PAN-OS 7.1.18

seanmccoy — Mon, 19 Nov 2018 17:13:12 GMT

I'm seeing sinkhole IP activity on two of my current PA security rules now that I've confirmed logging is enabled on both session start and end. The Block-Sinkhole security rule I've implemented to drop indicates one source address currently hitting the sinkhole IP.

Re: Configuring DNS sink hole on PA 3050 running PAN-OS 7.1.18

seanmccoy — Mon, 19 Nov 2018 17:25:03 GMT

I've refreshed the monitor and now it appears my sinkhole rule is dropping any source IP to the destination sinkhole IP. Thanks for all your help. Have a great holiday!

Re: Configuring DNS sink hole on PA 3050 running PAN-OS 7.1.18

seanmccoy — Mon, 19 Nov 2018 17:46:24 GMT

One other question is as to what I should be looking into as far as the threat log and the sinkhole type action. I'm still seeing that traffic to a few of my on premise domain controllers.

Re: Configuring DNS sink hole on PA 3050 running PAN-OS 7.1.18

BPry — Mon, 19 Nov 2018 18:26:34 GMT

@seanmccoy,

So I'm just guessing on your setup here, but I would expect with what you're seeing the domain controllers are also acting as your DNS servers? If that's the case, it simply means that one of the clients on your network is making DNS requests that match the published DNS Signatures, likely because the requested hostname is malicious in nature.

Unless you have a way to see the actual host -> DNS traffic, or you are loggign the DNS requests on the server, you really won't get a huge amount of actionable data. As of this moment the only thing you know for sure is that someone in your network is causing the DNS servers to make malicious DNS requests; without additional logs that isn't extremely helpful for you.