Configure a DNS Proxy Object
If your firewall is to act as a DNS proxy, perform this task to configure a DNS Proxy Object. The proxy object can either be shared among all virtual systems or applied to a specific virtual system.
When the firewall is enabled to act as a DNS proxy, evasion signatures that detected crafted HTTP or TLS requests can alert to instances where a client connects to a domain other than the domains specified in the original DNS query. As a best practice, Enable Evasion Signatures after configuring DNS proxy to trigger an alert if crafted requests are detected.
- Configure the basic settings for a DNS Proxy object.
- Select NetworkDNS Proxy and Add a new object.
- Verify that Enable is selected.
- Enter a Name for the object.
- For Location, select the virtual system to which the object applies. If you select Shared, you must specify at least a Primary DNS server address, and optionally a Secondary address.
- If you selected a virtual system, for Server Profile, select a DNS Server profile or else click DNS Server Profile to configure a new profile. See Configure a DNS Server Profile.
- For Inheritance Source, select a source from which to inherit default DNS server settings. The default is None.
- For Interface, click Add and
specify the interfaces to which the DNS Proxy object applies.
- If you use the DNS Proxy object for performing DNS lookups, an interface is required. The firewall will listen for DNS requests on this interface, and then proxy them.
- If you use the DNS Proxy object for a service route, the interface is optional.
- (Optional) Specify DNS Proxy rules.
- On the DNS Proxy Rules tab, Add a Name for the rule.
- Turn on caching of domains resolved by this mapping if you want the firewall to cache the resolved domains.
- For Domain Name, Add one
or more domains, one entry per row, to which the firewall compares
FQDN queries. If a query matches one of the domains in the rule,
the query is sent to one of the following servers to be resolved
(depending on what you configured in the prior step):
DNS Proxy Rule and FQDN Matching describes how the firewall matches domain names in an FQDN to a DNS proxy rule. If no match is found, default DNS servers resolve the query.
- The Primary or Secondary DNS Server directly specified for this proxy object.
- The Primary or Secondary DNS Server specified in the DNS Server profile for this proxy object.
- Do one of the following, depending on what you set
the Location to:
- If you chose a virtual system, select a DNS Server profile.
- If you chose Shared, enter a Primary and optionally a Secondary address.
- Click OK.
- (Optional) Supply the DNS Proxy with static
FQDN-to-address entries. Static DNS entries allow the firewall to
resolve the FQDN to an IP address without sending a query to the
- On the Static Entries tab, Add a Name.
- Enter the Fully Qualified Domain Name (FQDN).
- For Address, Add the
IP address to which the FQDN should be mapped.You can provide additional IP addresses for an entry. The firewall will provide all of the IP addresses in its DNS response and the client chooses which address to use.
- Click OK.
- (Optional) Enable caching and configure other
advanced settings for the DNS Proxy.
- On the Advanced tab,
select TCP Queries to enable DNS queries
- Max Pending Requests—Enter the maximum number of concurrent, pending TCP DNS requests that the firewall will support (range is 64-256; default is 64).
- For UDP Queries Retries, enter:
- Interval (sec)—The length of time (in seconds) after which another request is sent if no response has been received (range is 1-30; default is 2).
- Attempts—The maximum number of UDP query attempts (excluding the first attempt) after which the next DNS server is queried (range is 1-30; default is 5.)
- Select Cache to enable the
firewall to cache FQDN-to-address mappings that it learns.
- Select Enable TTL to limit the length of time the firewall caches DNS resolution entries for the proxy object. Disabled by default.
- Enter Time to Live (sec), the number of seconds after which all cached entries for the proxy object are removed. After the entries are removed, new DNS requests must be resolved and cached again. Range is 60-86,400. There is no default TTL; entries remain until the firewall runs out of cache memory.
- Cache EDNS Responses—Select this if you want the firewall to cache partial DNS responses that are greater than 512 bytes. If a subsequent FQDN for a cached entry arrives, the firewall sends the partial DNS response. If you want full DNS responses (greater than 512 bytes), don’t select this option.
- On the Advanced tab, select TCP Queries to enable DNS queries using TCP.
- Commit your changes.Click OK and Commit.
DNS Proxy Settings
DNS Proxy Settings Click Add and configure the firewall to act as a DNS proxy. You can configure a maximum of 256 DNS proxies on ...
DNS Proxy Object
DNS Proxy Object When configured as a DNS proxy, the firewall is an intermediary between DNS clients and servers; it acts as a DNS server ...
DNS Proxy Overview
DNS Proxy Overview You can configure the firewall to act as a DNS server. First, create a DNS proxy and select the interfaces to which ...
Use Case 1: Firewall Requires DNS Resolution
Use Case 1: Firewall Requires DNS Resolution In this use case, the firewall is the client requesting DNS resolutions of FQDNs for Security policy rules, ...
Use Case 3: Firewall Acts as DNS Proxy Between Client and S...
Use Case 3: Firewall Acts as DNS Proxy Between Client and Server In this use case, the firewall is located between a DNS client and ...
Multi-Tenant DNS Deployments
Multi-Tenant DNS Deployments The firewall determines how to handle DNS requests based on where the request originated. An environment where an ISP has multiple tenants ...
Network > DNS Proxy
Network > DNS Proxy DNS servers perform the service of resolving a domain name with an IP address and vice versa. When you configure the ...
DNS Overview DNS performs a crucial role in enabling user access to network resources so that users need not remember IP addresses and individual computers ...
Global Services Settings
Global Services Settings Device > Setup > Services To control and redirect DNS queries between shared and specific virtual systems, you can use a DNS ...