DNS over TLS in 10.2.4

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

DNS over TLS in 10.2.4

L3 Networker

Hi All

 

it seems like late last year DNS over TLS feature has been added to Palo Alto firewalls

 

However I am having issues understanding where it needs to be configured, I did read the guides but still unclear

 

So my external dns is 1.1.1.1 and I use DNZ proxy, 1.1.1.1 does support dns over tls but for that a domain needs to be configured instead of the ip

https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-tls/

 

the dns proxy does not allow fqdns to be configured only ips....

 

I also have default dns security applied to a policy (per the guide it needs to "inspect traffic") but I don't know what that actually means (is that what packet capture is in there per dns category???)

I also created a description policy for tcp 853 - no hits there 

 

in the logs the firewall sends all the dns traffic over port 53, nothing goes over 853 

 

on a FortiGate it was very clear how this is set, but I am scratching my head how it's done on a palo alto

 

please advise?

thank you

1 accepted solution

Accepted Solutions

Community Team Member

Hi @nevolex ,

 

I was unable to find an existing feature request for it either.

You could ask your local SE to file a feature request for it after which you and everyone else can add their vote to it.

 

Kind regards,

-Kiwi.

LIVEcommunity team member, CISSP
Cheers,
Kiwi
Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

View solution in original post

2 REPLIES 2

L3 Networker

Ok, it looks like that Palo alto does not support that neither, that dns over tls support from the manual is for decryption purposes only in case if clients send traffic over tls, however what I mean is tls traffic dns forwarding, where the clients send the traffic via normal port 53, then the firewall sends that traffic over 853  to the external dns server like 1.1.1.1 for domain resolution

 

It looks Palo alto DNS Proxy app does not support secure dns at all:(

 

 

 

Community Team Member

Hi @nevolex ,

 

I was unable to find an existing feature request for it either.

You could ask your local SE to file a feature request for it after which you and everyone else can add their vote to it.

 

Kind regards,

-Kiwi.

LIVEcommunity team member, CISSP
Cheers,
Kiwi
Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.
  • 1 accepted solution
  • 1450 Views
  • 2 replies
  • 0 Likes
  • 101 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!