Configure DNS Sinkholing for a List of Custom Domains

1. Enable DNS sinkholing for the custom list of domains in an external dynamic list.
   1. Select ObjectsSecurity ProfilesAnti-Spyware.
   2. Modify an existing profile, or select one of the existing default profiles and clone it.
   3. Name the profile and select the DNS Signatures tab.
   4. Click Add and select External Dynamic Lists in the drop-down.
      If you have already created an external dynamic list of type: Domain List, you can select it from here. The drop-down does not display external dynamic lists of type URL or IP Address that you may have created.
   5. Configure the external dynamic list from the Anti-Spyware profile (see Configure the Firewall to Access an External Dynamic List). The Type is preset to Domain List.
   6. (Optional) In the Packet Capture drop-down, select single-packet to capture the first packet of the session or extended-capture to set between 1-50 packets. You can then use the packet captures for further analysis.
2. Verify the sinkholing settings on the Anti-Spyware profile.
   1. On the DNS Signatures tab, verify that the Action on DNS Queries is sinkhole.
   2. In the Sinkhole section, verify that Sinkhole is enabled. For your convenience, the default Sinkhole IP address is set to access a Palo Alto Networks server. Palo Alto Networks can automatically refresh this IP address through content updates.
      If you want to modify the Sinkhole IPv4 or Sinkhole IPv6 address to a local server on your network or to a loopback address, see Configure the Sinkhole IP Address to a Local Server on Your Network.

   3. Click OK to save the Anti-Spyware profile.
3. Attach the Anti-Spyware profile to a Security policy rule.
   1. Select PoliciesSecurity and select a security policy rule.
   2. On the Actions tab, select the Log at Session Start check box to enable logging.
   3. In the Profile Setting section, click the Profile Type drop-down to view all Profiles. From the Anti-Spyware drop-down and select the new profile.
   4. Click OK to save the policy rule.
4. Test that the policy action is enforced.
   1. View External Dynamic List Entries that belong to the domain list, and access a domain from the list.
   2. To monitor the activity on the firewall:
      1. Select ACC and add a URL Domain as a global filter to view the Threat Activity and Blocked Activity for the domain you accessed.
      2. Select MonitorLogsThreat and filter by (action eq sinkhole) to view logs on sinkholed domains.
5. Verify whether entries in the external dynamic list are ignored or skipped.
   Use the following CLI command on the firewall to review the details about the list.

   request system external-list show type domain name <list_name>

   For example:

   request system external-list show type domain name
   My_List_of_Domains_2015
   vsys1/EBLDomain:
   Next update at : Thu May 21 10:15:39 2015
   Source : https://1.2.3.4/My_List_of_Domains_2015
   Referenced : Yes
   Valid : Yes
   Number of entries : 3
   domains:www.example.com
   baddomain.com
   qqq.abcedfg.com

6. (Optional) Retrieve the external dynamic list on-demand.
   To force the firewall to retrieve the updated list on-demand instead of at the next refresh interval (the Repeat frequency you defined for the external dynamic list), use the following CLI command:

   request system external-list refresh type domain name  <list_name>

   As an alternative, you can use the firewall interface to Retrieve an External Dynamic List from the Web Server.