DNS Proxy - invalid EDNS response

[AKufner]

Hi all,

I'm having a issue with the DNS Proxy feature. I'm running a Palo Alto VM (9.1.8) in Azure and want to use the VM as DNS Proxy. As default DNS Server, I want to use AZURE DNS 168.63.129.16. Additionally I have some Proxy Rules for internal Domains via VPN to our On Prem Datacenter (DNS). 

DNS Lookups for On Prem are fine, but resolution via AZURE DNS is dropped. Im getting following Error in the DNS Logs 

2021-03-24 15:34:44.629 +0100 Error: pan_dnsproxy_process_server_pkt(pan_dnsproxy_pkt.c:1563): [AZURE DNS Proxy/42214/19678/Afacebook.com.]:[Drop Rcvd Server Pkt]: invalid EDNS response!
2021-03-24 15:34:44.629 +0100 Error: pan_dnsproxy_recv_server_udp_cb(pan_dnsproxy_udp.c:222): [udp]: fd 17 from 168.63.129.16 to 0.0.0.0 process server failed! 

I captured the Traffic to the AZURE DNS Server. Looks ok for me, the only thing i noticed is that the request querry is missing the additional OPT header. 

Any Advice on this issue would be great. 

Thanks a lot 🙂 

[nikoolayy1]

The EDNS OPT is described in https://tools.ietf.org/html/rfc6891 and this is extended DNS. There is an article with the same issue :

https://live.paloaltonetworks.com/t5/general-topics/edns0-packet-blocked/td-p/6789

As I don't see for Palo Alto to have made the option to allow EDNS, better check the Azure DNS config or ask their support to stop sending OPT records.Maybe the DNS message is too big or Azure are not following the standard for EDNS very well. The firewall normally should allow EDNS but it will not look at the EDNS data as it is not supported.

Seach the forum as there is much info about EDNS and the OPT and the request for enchancment FR ID : 2315 to Palo Alto.

If you see any Anti-Spyware signature under the Threats log for this, you may also stop it. Also test if enabling or disabling "Cache EDNS Responses" on the Firewall DNS proxy config will help. Outside of this check the Azure DNS and with their TAC.

[OtakarKlier · Accepted solution]

Hello,

When it comes to DNS, I highly recommend a secure DNS provider andnot one that will resolve anything. PaloAlto has one as a subscription, however there are others that are low cost/free you can use, OpenDNS, Quad9, etc.

This way you're protected from bad DNS using malware, etc.

https://skrzsecurity.net/securedns

Regards,

[AKufner]

Thank you all for the feedback. For further testing we will setup a Free DNS Proxy solution. 

Would be just easy for our POC in AZURE to use the Palo, but why should it be easy. 

One more thing i found out, a DNS request with "dig" works. With DIG the client adds in the request the OPT header and the Palo don't drops the request.