If your firewall is to act as a DNS proxy,
perform this task to configure a DNS
Proxy Object. The proxy object can either be shared among
all virtual systems or applied to a specific virtual system.
When the firewall is enabled to act as
a DNS proxy, evasion signatures that detected crafted HTTP or TLS
requests can alert to instances where a client connects to a domain
other than the domains specified in the original DNS query. As a
best practice, Enable Evasion Signatures after
configuring DNS proxy to trigger an alert if crafted requests are
detected.
Configure the basic settings for a DNS Proxy object.
Select
Network
DNS Proxy
and
Add
a
new object.
Verify that
Enable
is selected.
Enter a
Name
for the object.
For
Location
, select the virtual
system to which the object applies. If you select
For Inheritance Source, select a source from which
to inherit default DNS server settings. The default is
None
.
For
Interface
, click
Add
and
specify the interfaces to which the DNS Proxy object applies.
If you use the DNS Proxy object for performing
DNS lookups, an interface is required. The firewall will listen
for DNS requests on this interface, and then proxy them.
If you use the DNS Proxy object for a service route, the
interface is optional.
(
Optional
) Specify DNS Proxy rules.
On the
DNS Proxy Rules
tab,
Add
a
Name
for
the rule.
Turn on caching of domains resolved by
this mapping
if you want the firewall to cache the resolved domains.
For
Domain Name
,
Add
one
or more domains, one entry per row, to which the firewall compares
FQDN queries. If a query matches one of the domains in the rule,
the query is sent to one of the following servers to be resolved (depending
on what you configured in the prior step):
The
Primary
or
Secondary
DNS
Server directly specified for this proxy object.
The
Primary
or
Secondary
DNS
Server specified in the DNS Server profile for this proxy object.
DNS
Proxy Rule and FQDN Matching describes how the firewall matches
domain names in an FQDN to a DNS proxy rule. If no match is found,
default DNS servers resolve the query.
Do one of the following, depending on what you set
the
Location
to:
If you chose a virtual system, select a
DNS
Server profile
.
If you chose
Shared
, enter a
Primary
and
optionally a
Secondary
address.
Click
OK
.
(
Optional
) Supply the DNS Proxy with static
FQDN-to-address entries. Static DNS entries allow the firewall to
resolve the FQDN to an IP address without sending a query to the
DNS server.
On the
Static Entries
tab,
Add
a
Name
.
Enter the Fully Qualified Domain Name (
FQDN
).
For
Address
,
Add
the
IP address to which the FQDN should be mapped.
You can provide additional IP addresses for an entry. The
firewall will provide all of the IP addresses in its DNS response
and the client chooses which address to use.
Click
OK
.
Enable caching and configure other advanced settings
for the DNS Proxy.
On the
Advanced
tab,
select
TCP Queries
to enable DNS queries
using TCP.
Max Pending Requests
—Enter
the maximum number of concurrent, pending TCP DNS requests that
the firewall will support (range is 64-256; default is 64).
For
UDP Queries Retries
, enter:
Interval (sec)
—The length
of time (in seconds) after which another request is sent if no response has
been received (range is 1 to 30; default is 2).
Attempts
—The maximum number of UDP
query attempts (excluding the first attempt) after which the next
DNS server is queried (range is 1 to 30; default is 5.)
Select
Cache
to enable the
firewall to cache FQDN-to-address mappings that it learns. You must
enable
Cache
(enabled by default) if this
DNS proxy object is used for queries that the firewall generates
(that is, under
Device
Setup
Services
DNS
,
or under
Device
Virtual
Systems
and you select a virtual system
and
General
DNS Proxy
.
Select
Enable TTL
to limit
the length of time the firewall caches DNS resolution entries for
the proxy object. Disabled by default.
Enter
Time
to Live (sec)
, the number of seconds after which all
cached entries for the proxy object are removed. After the entries
are removed, new DNS requests must be resolved and cached again.
Range is 60-86,400. There is no default TTL; entries remain until
the firewall runs out of cache memory.
Cache EDNS Responses
—You must enable
this setting if this DNS proxy object is used for queries that the firewall
generates (that is, under
