DNS sinkhole v9.0.1

[ash83]

Have 2 HA VMs with 9.0.1

Following this article: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/threat-prevention/use-dns-queries-to-ident...

In section 3), how does this need to be configured ((addr.dst in 10.15.0.20) ) when using Palo Alto Networks Sinkhole IP (sinkhole.paloaltonetworks.com) ?

Thanks.

Ho

[OtakarKlier]

Hello,

Its whatever you configured in your anti-spyware policies.

Regards,

[ash83]

Hello,

From https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/threat-prevention/use-dns-queries-to-ident...

The IP addresses currently are IPv4—sinkhole.paloaltonetworks.com and a loopback address IPv6 address—::1. These address are subject to change and can be updated with content updates.

As per my previous update, in PAN-OS v9.0.1:

[MP18]

just use the configured IPV4 dns address

[Velo-JV]

The only options available are the loopback or the PAN URL:

There is no IPV4 available for the PAN networks. 

[reaper]

@Velo-JV in the drop-down, yes

Just type a different IP 🙂

[Velo-JV]

Ahh ok got it. Is there a list of available sinkhole IPs that Palo Alto hosts? I am following along their guide "See Infected Hosts that Attempted to Connect to a Malicious Domain" and the report you create needs you to specify a specific IP destination, which has gone away in 9.0.

Thank you,

Jonathan

[reaper]

The panw hosted one is sinkhole.paloaltonetworks.com, by you can use any IP, preferably something that's not on the internet and not in your network either (unless you have a Honeypot)

[Velo-JV]

Got it sounds good. Thanks for the quick response.