Query for DNS Security

[OsamaKhan]

Hello,

In anti-spyware Palo Alto DNS security option, the default action was already on alert.

We don't have DNS Security License.

1. What should be the default action which I keep? Should I keep on alert or sinkhole?

2. If I keep the action on sinkhole will it disturb DNS traffic?

[OtakarKlier]

Hello,

I always set it to sinkhole. It will use its ThreatPrevent signatures for this.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGECA0

Hope that helps.

[BPry · Accepted solution]

@OsamaKhan,

An important distinction to make here is that the only thing your firewall is going to record when you don't have a DNS Security license is the default-paloalto-dns listed under the 'Palo Alto Networks Content' signature source. If you don't have a DNS security subscription, it honestly doesn't matter what you put for any of the categories of the DNS Security categories as you'll never have any of the DNS Security signatures without a subscription. 

You can stage these options if you like, so that if you ever do get DNS Security you don't have to make any profile modifications, but until you actually activate that subscription they won't be doing anything for you. 

[OsamaKhan]

Hello @BPry,

Thank you for solving my query.