topic Re: About DNS security in General Topics

About DNS security

MRamadanAHafiez — Mon, 19 Apr 2021 13:47:16 GMT

Hello Bros,

I my network and my firewall 3220 setup I have a question regarding the DNS security feature.

If you go through creating an anti-spyware profile, and exactly in the DNS signature what is the difference between DNS signature source "Palo Alto networks content DNS signature sinkhole as an action" and " Palo Alto network DNS security and sinkhole as action"

what are difference between both sections DNS security protection and from license perspective ?

Re: About DNS security

nikoolayy1 — Mon, 19 Apr 2021 17:01:01 GMT

The one with "DNS security" in it uses another license and it is not free but provides updates in real time to the DNS signatures (it is something like Wildfire lisense for file attacks) and the other is the free feature that needs manual dynamic updates to update the signatures and it will not provide zero day attack defense (like the antivirus signatures).

If you have many DNS issues and have the money for the extra security then maybe you will want the DNS security:

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/content-inspection-features/dns-security

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/threat-prevention/dns-security/about-dns-security.html

Re: About DNS security

OtakarKlier — Mon, 19 Apr 2021 21:02:40 GMT

Hello,

DNS security is a big deal with all the threats out there. Here are some things I highly suggest you do:

Use a secure DNS provider such as OpenDNS, TitanHQ, or Quad9. Even PAN has one now
Only allow your Domain Controllers or DNS servers to get out for external DNS lookups. Goes along with point 1 above. Everything internal points to your internal DNS/Domain Controllers, and only they can get out to your secure DNS provider.
Enable all security features you are licensed for and apply them to all external and internal policies, you dont need to do URL filtering internally
Follow all best practices, etc.
Keep things simple, and think through them with a diagram.

Just some pointers.

Cheers!