DNS Sinkhole

[Doyenadmin]

Hi guys,

I have Threat prevention license in my PA-3200 Series firewall but when i configure dns sinkhole in antispyware I am getting Warning: "No Valid DNS Security License" during commit, do i need to buy DNS license to work with sinkhole feature. 

Please suggest.

[PavelK]

Hello @Doyenadmin

for DNS Sinkhole setup, the DNS Security License is not required. The Threat Prevention License is enough to enable this feature.

Could you please share a screen of your setup along with PAN-OS version?

I would also recommend to have a look into this KB to make sure that it is configured according to best practice: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGECA0

Kind Regards

Pavel

[aleksandar.astardzhiev]

Hi @Doyenadmin 

Just to add to @PavelK great answer it is important to point which DNS signature policy you have configured with sinkhole.

As you can see from the documentation "DNS Security" category requires the additional DNS Security license

Trying to use any of the above with action sinkhole or block will require additional license. And this is how it looks on 9.1 versions

[Doyenadmin · Accepted solution]

Hi Pavel,

Pan-os version is 10.1.5-h2, and as per KB article  if i'll use Paloalto Networks content signatures and action as sinkhole - i won't require DNS signature license.

and if i will go for DNS security signature, ill be requiring DNS license. 

correct me if i am wrong.

[PavelK · Accepted solution]

Thank you for reply @Doyenadmin, your understanding is correct.