How to test DNS Security Properly?

Reply
L4 Transporter

How to test DNS Security Properly?

In reading up on DNS Security I found that URL's provided for testing in the following document, Enabling DNS Security, do not accurately ensure DNS Security feature license is installed and configured. A very accurate indicator of this is that all of those URL's are adequately blocked on a firewall running PAN-OS 8.1.x due to the PAN-DB URL filtering policies most companies would have enabled.

 

Here is the suggested testing method from the above URL:

So this leads me to the questions...

  1. How DO you accurately test that DNS Security is blocking DGA, DNS Tunneling, etc.?
  2. Can the Administrator Guide please be updated to accurately describe the process ensuring proper enablement of the DNS Security advanced feature?

BTW, @PANW - Why is the Oilrig signature default action "alert" instead of blocking it? Using a strict profile is pretty essential.

 

If you have a successful test plan for DNS Security implementation please comment.

 

Thanks!

L4 Transporter

Re: How to test DNS Security Properly?

The steps provided were to show you that the DNS Sinkhole functionality was being actioned/"hit on".

While I agree that these same sites are probably used in the Content Profile for URL Categorization, testing was done to provide confirmation that DNS sinkhole was working.

 

I enabled the Spyware profile to use the licensed DNS security feature.

But, instead of using the default sinkhole.paloaltonetworks.com FQDN, I used a bogus 9.9.9.9 as my sinkhole.

 

Then I tested the 4 sites.

 

My traffic was blocked, not because of the URL.  In looking at the threat logs, I see the action of sinkhole against the IP of my device.

For confirmation, I filtered on the Traffic log, and saw 4 hits on a destination IP of 9.9.9.9, which were not there, prior to my testing.

 

Therefore, the DNS Security feature, along with sinkholing to a different IP, shows/provides me confidence that the DNS security feature worked, before the URL filtering profile (which may well have those 4 sites listed), but Spyware profile is what was triggered.

 

Thank you.

 

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!