Prisma SD-WAN DNS Use Cases
Prisma SD-WAN DNS Service use cases. DNS Service can provide almost
instant DNS resolution to client machines.
| Where Can I Use
This? | What Do I Need? |
|---|
The following sections provide details
and examples of some common Prisma SD-WAN DNS Service use cases.
DNS
Caching
DNS Service can provide almost instant DNS resolution
to client machines. This serves to increase perceived application
response and improve the overall user experience.
By default,
the maximum number of cached domains is 150. You may increase this
number by editing the DNS profile or with local DNS service overrides
at the element to a maximum of 10,000 cached DNS records. If you
specify the cache size as 0, DNS caching will be disabled. DNS caching
consumes minimal memory overhead, and you can safely configure the
maximum cache value on all Prisma SD-WAN device models.
Augmentation
of Enterprise DNS System
The Prisma SD-WAN DNS Service
does not replace an existing enterprise DNS system but can work
in conjunction to provide local control through centralized management.
The Prisma SD-WAN DNS service can easily augment the enterprise
DNS system by providing site-specific (local) DNS resolution. For
example, the same domain used across the enterprise can be resolved
to a different IP address depending on the client's location performing
the lookup. This allows for a simple yet scalable way to provide
granular control for local resolution.
DNS
System for Small Deployments
Acting as an authoritative
DNS server, you may configure the Prisma SD-WAN DNS Service to meet
a small network's needs. The Prisma SD-WAN DNS Service can support
multiple zones acting as an authoritative server while providing
support for all DNS record types.
Internet-Local
Resolution
SaaS applications rely upon local DNS resolution
to connect an end user with the closest node for any given application.
In most cases, you can configure the private network machines to
use private centralized DNS servers in a data center or other central
locations. These centralized DNS servers rely on DNS systems upstream
for authoritative information for zones outside of their responsibility.
Consuming
SaaS applications can result in resolution for nodes (local nodes
to the central DNS servers and not the branch office users).
Since
Prisma SD-WAN can configure the DNS Service to send domain name
resolution requests to one set of servers and other domain name
resolution requests to a different set of servers, this solves the
local DNS resolution. This is particularly useful for SaaS applications
that rely on local DNS resolution for optimal node selection.
Secure
DNS (DNSSEC)
Secure DNS (DNSSEC) attacks are a standard
method to facilitate the interception of traffic. You may deploy
the Secure DNS (DNSSEC) to mitigate the threat of a DNS-based attack.
DNSSEC adds a layer of trust to DNS by enforcing authentication
through the use of digital signatures. These signatures use public-key
cryptography.
The Prisma SD-WAN DNS Service can act in one
of two DNSSEC modes:
DNSSEC Proxy—In this operation
mode, the Prisma SD-WAN DNS Service will proxy secure DNS requests
received from a client to DNS servers configured for lookup. When
the upstream DNS server generates responses, the AD (Authenticated
DNS) flag in the responses is proxied by the Prisma SD-WAN DNS Service
to the client.
DNSSEC Server—In this operation
mode, the Prisma SD-WAN DNS Service will validate DNS replies and
cache DNSSEC data. You must add appropriate trust anchors to the
configuration to enable this service, and any upstream DNS servers must
be capable of handling DNSSEC requests.
IoT
DNS
In many cases, outside vendors manage IoT (Internet
of Things) devices and not by the network or application owners.
The Prisma SD-WAN DNS service can control domain name resolution
on a source address basis. This is further secure by combining the
Prisma SD-WAN DNS Services with the Prisma SD-WAN ZBFW.
DNS
Accounting
In some environments, both enterprise and carrier,
it must pass specific client metadata to the DNS server for accounting
purposes. You may configure the Prisma SD-WAN DNS Service to send
specific client attributes to the DNS server, including client MAC
address, element name, element ID, and other custom text.
