Benefits of using DNS Proxy?

[craymond]

Are there any Security benefits to using the current implementation of DNS proxy on the PAN? I have seen on the ver 6.0, a new feature called DNS sinkhole, but I don't think it will require the DNS proxy feature. Watchguard checks DNS headers and a couple of other criteria for DNS based attacks, but I don't see anything in PAN documentation that says the PAN Firewall does anything when used a DNS proxy.

Any thoughts?

[panos]

Cache, static entries, etc... But not the one like DNS sinkhole, it is different and it is a security feature..

[pulukas]

You are correct, the dns proxy feature is a performance feature and not a security feature.

[KiCheon.Lee]

If FW is set up  DNS proxy configuration, fw needs to have U-Turn NAT configuration?

May I disable U-Turn NAT rules?

Thanks.

[_slv_]

U-turn - no, but You need policy like:

to allow DNS traffic

Regards

SLawek

[panos]

if you use fqdn you'll not need.bu if you'll access with ip, you will.

[Gregoux]

Hello

the DNS sinkholing is not implemented by the DNS PROXY.

the DNS sinkholing is implemented by antispyware profile

regard's

[msullivan]

I think it depends on your policy.  If you do not have a rule that dictates what the valid upstream resolvers are, the proxy could provide that same benefit.  It could also help with split dns issues.

Cheers,

Mike