Configuring DNS sink hole on PA 3050 running PAN-OS 7.1.18

[seanmccoy]

 I need assistance configuring/verifying if DNS Sinkholing is correct on my PA3020 running PAN-OS 7.1.18.

[BPry]

@seanmccoy,

Here's the knowledgbase article for it HERE, if you have any specific questions please let us know. 

[seanmccoy]

This is what I see when I choose Palo Alto Networks Sinkhole IP from the drop down

[BPry]

@seanmccoy,

Okay so outside of a few customizations it looks like you already have it configured and the IP of the default Palo Alto sinkhole IP is just failing to load. At the bottom of that query is a link to a verification document on how you would verify things are properly sinholing, but you should effectively be getting the response of 72.5.65.111 if you attempt to lookup a host that matches one of the DNS Signatures that are published. 

[seanmccoy]

So I followed step 4 of the query and created the security rule with the Palo Alto Default sinkhole address (72.5.65.111) as the destination and moved it to the top. If I look at threat logs I still see my internal DNS servers IP addresses if I filter by app eq sinkhole.

[seanmccoy]

Anywhere I can verify that Palo Alto sinkhole IP object on the firewall?

[BPry · Accepted solution]

@seanmccoy,

There really isn't a way to verify the object easily on the firewall, you have to get involved with the XML files that actually make up the device and peek around in the tech support file. If you look at the traffic logs for the sinkhole IP do you see any activity, and have you verified that you've setup logging on the rule you created to deny the traffic? 

I wouldn't filter on the sinkhole app-id, that's kind of a bad test. 

[seanmccoy]

I'm seeing sinkhole IP activity on two of my current PA security rules now that I've confirmed logging is enabled on both session start and end. The Block-Sinkhole security rule I've implemented to drop indicates one source address currently hitting the sinkhole IP.

[seanmccoy]

I've refreshed the monitor and now it appears my sinkhole rule is dropping any source IP to the destination sinkhole IP. Thanks for all your help. Have a great holiday!

[seanmccoy]

One other question is as to what I should be looking into as far as the threat log and the sinkhole type action. I'm still seeing that traffic to a few of my on premise domain controllers.

[BPry]

@seanmccoy,

So I'm just guessing on your setup here, but I would expect with what you're seeing the domain controllers are also acting as your DNS servers? If that's the case, it simply means that one of the clients on your network is making DNS requests that match the published DNS Signatures, likely because the requested hostname is malicious in nature. 

Unless you have a way to see the actual host -> DNS traffic, or you are loggign the DNS requests on the server, you really won't get a huge amount of actionable data. As of this moment the only thing you know for sure is that someone in your network is causing the DNS servers to make malicious DNS requests; without additional logs that isn't extremely helpful for you.