topic DNS license and PAN OS 9.0 in General Topics

DNS license and PAN OS 9.0

MP18 — Thu, 13 Jun 2019 04:08:26 GMT

During Ignite we were told that DNS is coming as license service in PAN OS9.0.

Need to know is this service different from dns sinkhole?

IF it is how it is ?

Re: DNS license and PAN OS 9.0

reaper — Thu, 13 Jun 2019 06:42:41 GMT

It's an additional database for DNS sinkhole, but the original ThreatPrevention database is loaded each time a dynamic update is downloaded and installed and is static, while the new DNS Security Service works more like URL filtering as it looks up each DNS request and gets a match from the cloud https://docs.paloaltonetworks.com/dns-security

Re: DNS license and PAN OS 9.0

MP18 — Thu, 13 Jun 2019 17:12:43 GMT

Thanks for the useful link.

Does it mean that on PAN OS 8.1 we have limited signatures when i check on antispyware it shows 7650?

On PAN OS 9.0 using DNS license how many we have in cloud any idea?

Currently if we are using application as DNS and service as app-default will this protect us with dns tunneling on PAN OS 8.1?

Regards

Mike

Re: DNS license and PAN OS 9.0

santonic — Fri, 14 Jun 2019 05:35:42 GMT

DNS security doesn't use signatures on the device. It is a cloud service, every DNS query is sent to PA cloud to be checked.

To use it you need the license and PAN-OS 9.0.

DNS with app default doesnt protect you from DNS tunneling because the DNS queries used for it are compatible with the protocol.