Prisma SD-WAN DNS Use Cases
Table of Contents
Expand all | Collapse all
-
-
- Add a Branch
- Add a Data Center
- Add a Branch Gateway
- Configure Circuits
- Configure Internet Circuit Underlay Link Aggregation
- Configure Private WAN Underlay Link Quality Aggregation
- Configure Circuit Categories
- Configure Device Initiated Connections for Circuits
- Add Public IP LAN Address to Enterprise Prefixes
- Manage Data Center Clusters
- Configure a Site Prefix
- Configure a DHCP Server
- Configure NTP for Prisma SD-WAN
- Enable IoT Device Visibility in Prisma SD-WAN
- Configure the ION Device at a Branch Site
- Configure the ION Device at a Data Center
- Switch a Site to Control Mode
- Allow IP Addresses in Firewall Configuration
-
- Configure a Controller Port
- Configure Internet Ports
- Configure WAN/LAN Ports
- Configure a Loopback Interface
- Configure a PoE Port
- Configure and Monitor LLDP Activity and Status
- Configure a PPPoE Interface
- Configure a Layer 3 LAN Interface
- Configure Application Reachability Probes
- Configure a Secondary IP Address
- Configure a Static ARP
- Configure a DHCP Relay
- Configure IP Directed Broadcast
- VPN Keep-Alives
-
- Configure Prisma SD-WAN IPFIX
- Configure IPFIX Profiles and Templates
- Configure and Attach a Collector Context to a Device Interface in IPFIX
- Configure and Attach a Filter Context to a Device Interface in IPFIX
- Configure Global and Local IPFIX Prefixes
- Flow Information Elements
- Options Information Elements
- Configure the DNS Service on the Prisma SD-WAN Interface
- Configure SNMP
-
-
- Prisma SD-WAN Branch Routing
- Prisma SD-WAN Data Center Routing
-
- Configure Multicast
- Create a WAN Multicast Configuration Profile
- Assign WAN Multicast Configuration Profiles to Branch Sites
- Configure a Multicast Source at a Branch Site
- Configure Global Multicast Parameters
- Configure a Multicast Static Rendezvous Point (RP)
- Learn Rendezvous Points (RPs) Dynamically
- View LAN Statistics for Multicast
- View WAN Statistics for Multicast
- View IGMP Membership
- View the Multicast Route Table
- View Multicast Flow Statistics
- View Routing Statistics
- Prisma SD-WAN Incident Policies
-
- Prisma SD-WAN Branch HA Key Concepts
- Configure Branch HA
- Configure HA Groups
- Add ION Devices to HA Groups
- View Device Configuration of HA Groups
- Edit HA Groups and Group Membership
-
- Configure Branch HA with Gen-1 Platforms (2000, 3000, 7000, and 9000)
- Configure Branch HA with Gen-2 Platforms (3200, 5200, and 9200)
- Configure Branch HA with Gen-2 Embedded Switch Platforms (1200-S or 3200-L2)
- Configure Branch HA for Devices with Software Cellular Bypass (1200-S-C-5G)
- Configure Branch HA for Platforms without Bypass Pairs
- Prisma SD-WAN Clarity Reports
- Prisma SD-WAN Incidents and Alerts
Prisma SD-WAN DNS Use Cases
Prisma SD-WAN
DNS Use CasesPrisma SD-WAN
DNS Service use cases. DNS Service can provide almost
instant DNS resolution to client machines. The following sections provide details
and examples of some common
Prisma SD-WAN
DNS Service use cases.DNS
Caching
DNS Service can provide almost instant DNS resolution
to client machines. This serves to increase perceived application
response and improve the overall user experience.
By default,
the maximum number of cached domains is 150. You may increase this
number by editing the DNS profile or with local DNS service overrides
at the element to a maximum of 10,000 cached DNS records. If you
specify the cache size as 0, DNS caching will be disabled. DNS caching
consumes minimal memory overhead, and you can safely configure the
maximum cache value on all
Prisma SD-WAN
device models.Augmentation
of Enterprise DNS System
The
Prisma SD-WAN
DNS Service
does not replace an existing enterprise DNS system but can work
in conjunction to provide local control through centralized management.
The Prisma SD-WAN
DNS service can easily augment the enterprise
DNS system by providing site-specific (local) DNS resolution. For
example, the same domain used across the enterprise can be resolved
to a different IP address depending on the client's location performing
the lookup. This allows for a simple yet scalable way to provide
granular control for local resolution.DNS
System for Small Deployments
Acting as an authoritative
DNS server, you may configure the
Prisma SD-WAN
DNS Service to meet
a small network's needs. The Prisma SD-WAN
DNS Service can support
multiple zones acting as an authoritative server while providing
support for all DNS record types.Internet-Local
Resolution
SaaS applications rely upon local DNS resolution
to connect an end user with the closest node for any given application.
In most cases, you can configure the private network machines to
use private centralized DNS servers in a data center or other central
locations. These centralized DNS servers rely on DNS systems upstream
for authoritative information for zones outside of their responsibility.
Consuming
SaaS applications can result in resolution for nodes (local nodes
to the central DNS servers and not the branch office users).
Since
Prisma SD-WAN
can configure the DNS Service to send domain name
resolution requests to one set of servers and other domain name
resolution requests to a different set of servers, this solves the
local DNS resolution. This is particularly useful for SaaS applications
that rely on local DNS resolution for optimal node selection.Secure
DNS (DNSSEC)
Secure DNS (DNSSEC) attacks are a standard
method to facilitate the interception of traffic. You may deploy
the Secure DNS (DNSSEC) to mitigate the threat of a DNS-based attack.
DNSSEC adds a layer of trust to DNS by enforcing authentication
through the use of digital signatures. These signatures use public-key
cryptography.
The
Prisma SD-WAN
DNS Service can act in one
of two DNSSEC modes:- DNSSEC Proxy—In this operation mode, thePrisma SD-WANDNS Service will proxy secure DNS requests received from a client to DNS servers configured for lookup. When the upstream DNS server generates responses, the AD (Authenticated DNS) flag in the responses is proxied by thePrisma SD-WANDNS Service to the client.
- DNSSEC Server—In this operation mode, thePrisma SD-WANDNS Service will validate DNS replies and cache DNSSEC data. You must add appropriate trust anchors to the configuration to enable this service, and any upstream DNS servers must be capable of handling DNSSEC requests.
IoT
DNS
In many cases, outside vendors manage IoT (Internet
of Things) devices and not by the network or application owners.
The
Prisma SD-WAN
DNS service can control domain name resolution
on a source address basis. This is further secure by combining the
Prisma SD-WAN
DNS Services with the Prisma SD-WAN
ZBFW.DNS
Accounting
In some environments, both enterprise and carrier,
it must pass specific client metadata to the DNS server for accounting
purposes. You may configure the
Prisma SD-WAN
DNS Service to send
specific client attributes to the DNS server, including client MAC
address, element name, element ID, and other custom text.