Using Minemeld to do FQDN refresh for security rules

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Using Minemeld to do FQDN refresh for security rules

L1 Bithead

So we recently started having trouble with our Palo's saying that the FQDN refresh job finished sucessfully but the items still TTL out and die. While waiting for support to look into it it occurs to me that I might beable to feed Minemeld a list of URL's and have it do the resolution and pump the results back to PAN. Anyone have any experience with this?

1 accepted solution

Accepted Solutions

Hi @david.sherrill ,

 

yes. I'm afraid you need a new node (miner) per FQDN (details in the Google DNS API specification at https://developers.google.com/speed/public-dns/docs/dns-over-https)

If you're planning to configure 10's or more of them then you might want to take a look to the FQDN-Service project (AWS Serverless Component you can deploy at almost no montly cost and that can resolve 100's of FQDN's at once)

 

Xavi

View solution in original post

5 REPLIES 5

L4 Transporter

Can't help with the question, but I can say we've been having loads of issues with FQDN refreshes on our firewalls recently.  Don't know why its started to get worse (or if its just perception) but we have multiple open tickets in this space...!



 

L7 Applicator

You could use Google DNS JSON API to do it:

  • click on the AWS.AMAZON prototype
  • click on NEW
  • Paste the following in the prototype section (changed the hostname to be resolved :-))
{
   "age_out": {
      "default": null,
      "interval": 257,
      "sudden_death": true
   },
   "attributes": {
      "confidence": 100,
      "share_level": "green",
      "type": "IPv4"
   },
   "extractor": "Answer[?type==`1`].data.{indicator: @}",
   "indicator": "indicator",
   "prefix": "dns",
   "source_name": "dns.PaloAltoNetworks",
   "url": "https://dns.google.com/resolve?name=www.paloaltonetworks.com"
}

Going to try this today but it looks like it will work perfectly! Thanks I will report back!

It definatly works as expected, one question though is there an easy way to add new entries, or am I basically making a new one everytime I need to add a new URL?

 

Thanks!

Hi @david.sherrill ,

 

yes. I'm afraid you need a new node (miner) per FQDN (details in the Google DNS API specification at https://developers.google.com/speed/public-dns/docs/dns-over-https)

If you're planning to configure 10's or more of them then you might want to take a look to the FQDN-Service project (AWS Serverless Component you can deploy at almost no montly cost and that can resolve 100's of FQDN's at once)

 

Xavi

  • 1 accepted solution
  • 8656 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!