Cloud NGFW for AWS
    : Private Hosted Zone DNS
    Focus
    Download PDF
    Focus
    1. Home
    2. AWS
    3. Cloud NGFW for AWS
    4. Cloud NGFW for AWS Security Features
    5. Configure DNS Security
    6. Private Hosted Zone DNS
    Download PDF

    Cloud NGFW for AWS

    Private Hosted Zone DNS

    Table of Contents

    Private Hosted Zone DNS

    Learn how to direct DNS queries from a Private Hosted Zone DNS to Cloud NGFW.
    To create a Private Hosted zone in AWS, see Creating a private hosted zone.
    To allow your Cloud NGFW resource to query Route 53 Resolver for any DNS zones (e.g., Private Zones) hosted on Route 53, you create a Route 53 Inbound Endpoint as discussed earlier. The Inbound Endpoint is a bridge for other services to query Route 53 for domain name resolution. When you create an Inbound Endpoint, AWS creates an elastic network interface (ENI) in each availability zone (AZ) that you specify will receive inbound DNS queries.
    1. Open the Amazon VPC console.
    2. Create an inbound endpoint.
      1. Select ServicesRoute 53ResolverInbound Endpoints.
      2. Click Create inbound endpoint.
      3. Enter a descriptive Name.
      4. Select the VPC for the endpoint.
      5. Attach a security group for this endpoint.
      6. Set the Endpoint Type to IPv4.
      7. Select the availability zone.
      8. Select the subnet you created above.
        If you have more than one availability zone, you must specify the availability zone and subnet for each.
      9. Click Create inbound endpoint.
      10. Note the IP address associated with each subnet attached to your inbound endpoint. Use these IP addresses when configuring your DHCP option sets in the following steps.
    3. Select VPCDHCP option sets.
    4. You can create a new DHCP option set and add the IP address for each availability zone. If you have more than one availability zone, enter each IP address as a comma-separated list.
    5. Select VPC and choose the VPC to secure.
    6. From the Actions drop-down, select Edit VPC settings.
    7. Under DHCP settings, choose the DHCP option set with you created above from the DHCP option set drop-down.
    8. Click Save changes.
    9. Edit your subnet route table.
      1. Select VPCRoute Tables.
      2. Select the route table for the subnet you want to secure.
      3. Add a route and set the destination to the IP address of your DNS server and set the target to the Cloud NGFW endpoint.
      4. Click Save changes.
        Any DNS traffic from the protected subnet is routed through the Cloud NGFW endpoint and on to the Cloud NGFW for inspection and enforcement.

    © 2024 Palo Alto Networks, Inc. All rights reserved.