Question/FR for mining rDNS zones?

[mpetzold]

I have a environment that is currently using rDNS to identify host security policies, and it has older Checkpoint firewalls use this data dynamically via CP Domain Objects to tie rDNS lookups to security policies. This obviously has some challenges and scaling limitations, but fundamentally allows system owners to classify common devices into pre-existing security policies by tying those hosts to certain rDNS names (i.e., 1.1.1.1 = service-a.company.com). From a change control perspective, it eliminates much of the low level firewall policy change work.

I’m looking to try to mimic this behavior on PAN-OS devices, as ideally this would allow for similar policies & workflow regardless of CP or PANW policy enforcement. Because the data is already stored in rDNS zone files today, it’s the ideal source, though would need to be processed a bit before it could be ingested as an EDL, and the thought occurred to me that Minemeld might be a good candidate to do that.

I've only begun digging into Minemeld, though I believe some logic would need to be written to piece together the IP/Host information from the zone file, given that the rDNS zone format is no the most straight forward in the world. Any thoughts on how feasible this might be? Alternatively, might there be an easier way with the existing Minemeld miners/prototypes to accomplish this?

Thanks,
Mark

[lmori]

Hi Mark,

this could be possible, even if not super elegant. If your current DNS server support zone transfers, a DNS miner could be implemented to process the items from the rDNS zone. 

Note: A DNS miner could also be useful for mining Google address ranges (https://support.google.com/a/answer/60764?hl=en) and potentially DNS RPZ.

luigi