DNS license and PAN OS 9.0

[MP18]

During Ignite we were told that DNS is coming as license service in PAN OS9.0.

Need to know is this service different from dns sinkhole?

IF it is how it is ?

[reaper]

It's an additional database for DNS sinkhole, but the original ThreatPrevention database is loaded each time a dynamic update is downloaded and installed and is static, while the new DNS Security Service works more like URL filtering as it looks up each DNS request and gets a match from the cloud https://docs.paloaltonetworks.com/dns-security

[MP18]

Thanks for the useful link.

Does it mean that on PAN OS 8.1 we have limited signatures when i check on antispyware it shows 7650?

On PAN OS 9.0  using DNS license how many we have in cloud any idea?

Currently if we are using application as DNS and service as app-default will this protect us with dns tunneling on PAN OS 8.1?

Regards

Mike

[santonic]

DNS security doesn't use signatures on the device. It is a cloud service, every DNS query is sent to PA cloud to be checked.

To use it you need the license and PAN-OS 9.0. 

DNS with app default doesnt protect you from DNS tunneling because the DNS queries used for it are compatible with the protocol.