In reading up on DNS Security I found that URL's provided for testing in the following document, Enabling DNS Security, do not accurately ensure DNS Security feature license is installed and configured. A very accurate indicator of this is that all of those URL's are adequately blocked on a firewall running PAN-OS 8.1.x due to the PAN-DB URL filtering policies most companies would have enabled.
Here is the suggested testing method from the above URL:
So this leads me to the questions...
BTW, @PANW - Why is the Oilrig signature default action "alert" instead of blocking it? Using a strict profile is pretty essential.
If you have a successful test plan for DNS Security implementation please comment.
The steps provided were to show you that the DNS Sinkhole functionality was being actioned/"hit on".
While I agree that these same sites are probably used in the Content Profile for URL Categorization, testing was done to provide confirmation that DNS sinkhole was working.
I enabled the Spyware profile to use the licensed DNS security feature.
But, instead of using the default sinkhole.paloaltonetworks.com FQDN, I used a bogus 188.8.131.52 as my sinkhole.
Then I tested the 4 sites.
My traffic was blocked, not because of the URL. In looking at the threat logs, I see the action of sinkhole against the IP of my device.
For confirmation, I filtered on the Traffic log, and saw 4 hits on a destination IP of 184.108.40.206, which were not there, prior to my testing.
Therefore, the DNS Security feature, along with sinkholing to a different IP, shows/provides me confidence that the DNS security feature worked, before the URL filtering profile (which may well have those 4 sites listed), but Spyware profile is what was triggered.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!