Custom DNS name

[jdprovine]

We have a DNS name genieo that is not being recognized and is not included in the signatures. Two things first is there a way to identify it with a custome signature with the object/anti-spyware  and then be able to send it to a sinkhole?

[Raido_Rattameister]

You could:

- use custom URL category and block this traffic

- use DNS Proxy and fake some random (localhost) ip as answer

- if running 7.1 use Dynamic Lists with type URL to create custom url categories and block in the policy

[jdprovine]

Do you have to have the URL filtering subscription to do these two?

- use custom url category and block this traffic

- if running 7.1 use the Dynamic Lists with the URL to create custom url categories and block the policy

[Raido_Rattameister]

No

[jdprovine]

Good I will check it out

[jdprovine]

I don't see options to sinkhole these only to block etc. My manager wants to be able to sinkhole.

[BPry]

jprovine,

If you look at the following I'm fairly certain that you can accomplish this fairly easily with anti-spyware filtering.

[jdprovine]

Good suggestion but I tried that but I didn't see a way to sinkhole it only to block or reset just the basic but no sinkhole option than I can find, if you want give me the instruction maybe I missing it

[jdprovine]

Good suggestion but I tried that and I didn't see a way to sinkhole it, only to block or reset just the basic but no sinkhole option than I can find, if you want give me the instruction maybe I missing it

[Raido_Rattameister]

You have to run 7.1 to include your custom url lists into sinkhole.

With 7.0 or below you have to use DNS Proxy and use this to send back fake DNS replies back.

[jdprovine]

Good information I am currently on 6.1.11 so that is not a option for me at this point