Query for DNS Security

Reply
OsamaKhan
L2 Linker

Query for DNS Security

Hello,

 

In anti-spyware Palo Alto DNS security option, the default action was already on alert.

We don't have DNS Security License.

1. What should be the default action which I keep? Should I keep on alert or sinkhole?

2. If I keep the action on sinkhole will it disturb DNS traffic?

 

 

 

Thanks and Regards,
OK.

Accepted Solutions
BPry
Cyber Elite

@OsamaKhan,

An important distinction to make here is that the only thing your firewall is going to record when you don't have a DNS Security license is the default-paloalto-dns listed under the 'Palo Alto Networks Content' signature source. If you don't have a DNS security subscription, it honestly doesn't matter what you put for any of the categories of the DNS Security categories as you'll never have any of the DNS Security signatures without a subscription. 

You can stage these options if you like, so that if you ever do get DNS Security you don't have to make any profile modifications, but until you actually activate that subscription they won't be doing anything for you. 

View solution in original post


All Replies
OtakarKlier
Cyber Elite

Hello,

I always set it to sinkhole. It will use its ThreatPrevent signatures for this.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGECA0

 

Hope that helps.

BPry
Cyber Elite

@OsamaKhan,

An important distinction to make here is that the only thing your firewall is going to record when you don't have a DNS Security license is the default-paloalto-dns listed under the 'Palo Alto Networks Content' signature source. If you don't have a DNS security subscription, it honestly doesn't matter what you put for any of the categories of the DNS Security categories as you'll never have any of the DNS Security signatures without a subscription. 

You can stage these options if you like, so that if you ever do get DNS Security you don't have to make any profile modifications, but until you actually activate that subscription they won't be doing anything for you. 

View solution in original post

OsamaKhan
L2 Linker

Hello @BPry,

 

Thank you for solving my query.

Thanks and Regards,
OK.
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!