topic Re: Query for DNS Security in General Topics

Query for DNS Security

OsamaKhan — Thu, 14 Jan 2021 12:13:22 GMT

Hello,

In anti-spyware Palo Alto DNS security option, the default action was already on alert.

We don't have DNS Security License.

1. What should be the default action which I keep? Should I keep on alert or sinkhole?

2. If I keep the action on sinkhole will it disturb DNS traffic?

Re: Query for DNS Security

OtakarKlier — Thu, 14 Jan 2021 23:08:57 GMT

Hello,

I always set it to sinkhole. It will use its ThreatPrevent signatures for this.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGECA0

Hope that helps.

Re: Query for DNS Security

BPry — Thu, 14 Jan 2021 23:18:39 GMT

@OsamaKhan,

An important distinction to make here is that the only thing your firewall is going to record when you don't have a DNS Security license is the default-paloalto-dns listed under the 'Palo Alto Networks Content' signature source. If you don't have a DNS security subscription, it honestly doesn't matter what you put for any of the categories of the DNS Security categories as you'll never have any of the DNS Security signatures without a subscription.

You can stage these options if you like, so that if you ever do get DNS Security you don't have to make any profile modifications, but until you actually activate that subscription they won't be doing anything for you.

Re: Query for DNS Security

OsamaKhan — Fri, 15 Jan 2021 10:01:42 GMT

Hello @BPry,

Thank you for solving my query.