Submitting DNS block without blocking the IP

[dlevenden]

I'm looking to submit a FQDN block where I don't ever block the IP.

I've reviewed this article on blocking FQDN's but can't seem to figure out how to ignore the IP. We assign fake ip addresses to known malicius sites, and need the HTTP, HTTPS, SSH, etc traffic to route back to us, but the block on the FQDN is also blocking the IP once the lookup is processed.

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-and-Test-FQDN-Objects/t...

Any suggestions?

Thanks.

[BenjAudy.MTL]

I'm not sure I understand your problem. You mean you have a blocking rule with the FQDN as the destination address? If you want to reroute the traffic to some identified malicious websites, why do you have a blocking rule in the first place?

Benjamin

[dlevenden]

great question. We offer a service to a customer that blocks on a paloAlto system at their end, which we're fine with them blocking the FQDN, but we need to not block the IP at the same time to allow other traffic to make it through if the name/domain isn't blocked on the customer side.

Thanks.

[mivaldi · Accepted solution]

Check dns-req-section in page 19 of this document:

Creating Custom Application and Threat Signatures

There's an example for FQDN www.thebayareagamers.com

You can also add an EDL of type "Domain" and point it to a web-server that contains the list of domains you want to block.

See: https://live.paloaltonetworks.com/t5/tkb/articleprintpage/tkb-id/PANOS71Articles/article-id/10