Click Add and configure the firewall to act as a DNS proxy. You can configure a maximum of 256 DNS proxies on a firewall.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
•
|
Shared: Proxy applies to all virtual systems. If you choose Shared, the Server Profile field is not available. Instead, enter the Primary and Secondary DNS server IP addresses or address objects.
|
|
|
|
|
|
|
|
|
|
|
(Virtual System location only)
|
|
|
|
Add an interface to function as a DNS proxy. You can add multiple interfaces. To remove the DNS proxy from an interface, select and Delete it.
|
|
|
|
|
|
|
|
|
|
Add one or more domain names to which the firewall compares incoming FQDNs. If the FQDN matches one of the domains in the rule, the firewall forwards the query to the Primary/Secondary DNS server specified for this proxy. To delete a domain name from the rule, select it and click Delete.
|
|
|
|
(Virtual System location only)
|
|
|
|
|
|
|
|
|
|
|
Add one or more IP addresses that map to this domain. The firewall includes all of these addresses in its DNS response, and the client chooses which IP address to use. To delete an address, select the address and click Delete.
|
(PAN-OS 11.2.1 and later releases) Enable Encrypted DNS
|
|
|
(PAN-OS 11.2.1 and later releases) Connection Type
|
|
•
|
DoH—DNS over HTTPS (Hypertext Transfer Protocol Secure). DoH uses port 443. No other HTTPS services are allowed on the interface that is acting as a DNS proxy. An SSL decryption policy must be configured from the DNS client to DNS server so that the DNS proxy can decrypt DoH traffic.
|
|
•
|
DoT—DNS over TLS (Transport Layer Security). DoT uses port 853, which is dedicated to DoT traffic. No other TLS services are allowed on the interface that is acting as a DNS proxy.
|
|
•
|
Origin—DNS proxy sends all DNS requests to the primary DNS server using the same DNS type as that originally received from the client. If the DNS proxy receives no DNS response from the primary DNS server within the TCP timeout period, the DNS proxy sends the DNS request to the secondary DNS server.
|
|
•
|
Cleartext—Plain, unencrypted DNS; no encrypted DNS when the DNS proxy connects to the DNS server.
|
|
(PAN-OS 11.2.1 and later releases) Fallback on Unencrypted DNS
|
|
(PAN-OS 11.2.1 and later releases) TCP Timeout (sec)
|
|
(PAN-OS 11.2.1 and later releases) Allowed DNS Types
|
|
•
|
DoH—DNS proxy must decrypt DoH traffic and proxy DNS as specified for Server Settings.
|
|
•
|
DoT—DNS proxy must decrypt DoT traffic and proxy DNS as specified for Server Settings.
|
|
•
|
Cleartext—DNS proxy must proxy DNS as specified for Server Settings.
|
|
(PAN-OS 11.2.1 and later releases) SSL/TLS Service Profile
|
|
|
|
|
|
|
|
|
|
•
|
Interval—Time, in seconds, after which the DNS proxy sends another request if it hasn’t received a response (range is 1 to 30; default is 2).
|
|
•
|
Attempts—Maximum number of attempts (excluding the first attempt) after which the DNSP tries the next DNS server (range is 1 to 30; default is 5).
|
|
|
|
|
You must have Cache enabled (enabled by default) if this DNS proxy object is used for queries that the firewall generates (that is, under Device > Setup > Services > DNS, or under Device > Virtual Systems and you select a virtual system and General > DNS Proxy). Then specify the following:
|
•
|
Enable TTL—Limit the length of time the firewall caches DNS entries for the proxy object. TTL is disabled by default. Then enter Time to Live (sec)—the number of seconds after which all cached entries for the proxy object are removed and new DNS requests must be resolved and cached again. Range is 60 to 86,400. There is no default TTL; entries remain until the firewall runs out of cache memory.
|
|
•
|
Cache EDNS Responses—You must enable Cache Extension Mechanisms for DNS (EDNS) Responses if this DNS proxy object is used for queries that the firewall generates. The firewall must be able to cache DNS responses in order for the queries for FQDN address objects to succeed.
|
|