Using Minemeld to do FQDN refresh for security rules

Reply
L1 Bithead

Using Minemeld to do FQDN refresh for security rules

So we recently started having trouble with our Palo's saying that the FQDN refresh job finished sucessfully but the items still TTL out and die. While waiting for support to look into it it occurs to me that I might beable to feed Minemeld a list of URL's and have it do the resolution and pump the results back to PAN. Anyone have any experience with this?

L4 Transporter

Re: Using Minemeld to do FQDN refresh for security rules

Can't help with the question, but I can say we've been having loads of issues with FQDN refreshes on our firewalls recently.  Don't know why its started to get worse (or if its just perception) but we have multiple open tickets in this space...!



 

L7 Applicator

Re: Using Minemeld to do FQDN refresh for security rules

You could use Google DNS JSON API to do it:

  • click on the AWS.AMAZON prototype
  • click on NEW
  • Paste the following in the prototype section (changed the hostname to be resolved :-))
{
   "age_out": {
      "default": null,
      "interval": 257,
      "sudden_death": true
   },
   "attributes": {
      "confidence": 100,
      "share_level": "green",
      "type": "IPv4"
   },
   "extractor": "Answer[?type==`1`].data.{indicator: @}",
   "indicator": "indicator",
   "prefix": "dns",
   "source_name": "dns.PaloAltoNetworks",
   "url": "https://dns.google.com/resolve?name=www.paloaltonetworks.com"
}
L1 Bithead

Re: Using Minemeld to do FQDN refresh for security rules

Going to try this today but it looks like it will work perfectly! Thanks I will report back!

L1 Bithead

Re: Using Minemeld to do FQDN refresh for security rules

It definatly works as expected, one question though is there an easy way to add new entries, or am I basically making a new one everytime I need to add a new URL?

 

Thanks!

Highlighted
L5 Sessionator

Re: Using Minemeld to do FQDN refresh for security rules

Hi @david.sherrill ,

 

yes. I'm afraid you need a new node (miner) per FQDN (details in the Google DNS API specification at https://developers.google.com/speed/public-dns/docs/dns-over-https)

If you're planning to configure 10's or more of them then you might want to take a look to the FQDN-Service project (AWS Serverless Component you can deploy at almost no montly cost and that can resolve 100's of FQDN's at once)

 

Xavi

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!