FQDN rules and DNS features

[bdaussin]

Hi all,

We started using FQDN rules few days ago. The purpose, once again, is to remove "basic IP rules" and to allow the team in charge of server to move their application without asking to change Firewall rules all the time. So, it works great but we have some limitations. Because the PAN device takes into account the TTL value, it will send DNS request every TTL value. On the PAN device, we can ask to force the refresh every 4 hours, but no less. 4 hours is quite a long time.....

To make the behaviour more dynamic and because PAN devices are "application aware" firewalls, it should be possible to inspect DNS traffic running from the clients to the DNS servers. The idea here would be to inspect responses from the internal DNS ( trusted ) and make the PAN devices update their DNS table with these informations.

I would like to get your feed back about this proposal.

Thanks you.

[bdaussin]

someone ?

[bpappas]

This would be a feature request and should be directed to your sales team so that they may submit it on your behalf.

-Benjamin

[bdaussin]

Thanks,

I've already sent the feature request to our sales teams. Here I just want to have Palo Alto and other customer's feedback about the usefullness and security aspects of the feature.

Benjamin