DNS Service can provide almost instant DNS resolution to client machines. This serves to increase perceived application response and improve the overall user experience.

By default, the maximum number of cached domains is 150. You may increase this number by editing the DNS profile or with local DNS service overrides at the element to a maximum of 10,000 cached DNS records. If you specify the cache size as 0, DNS caching will be disabled. DNS caching consumes minimal memory overhead, and you can safely configure the maximum cache value on all Prisma SD-WAN device models.

Augmentation of Enterprise DNS System

The Prisma SD-WAN DNS Service does not replace an existing enterprise DNS system but can work in conjunction to provide local control through centralized management. The Prisma SD-WAN DNS service can easily augment the enterprise DNS system by providing site-specific (local) DNS resolution. For example, the same domain used across the enterprise can be resolved to a different IP address depending on the client's location performing the lookup. This allows for a simple yet scalable way to provide granular control for local resolution.

DNS System for Small Deployments

Acting as an authoritative DNS server, you may configure the Prisma SD-WAN DNS Service to meet a small network's needs. The Prisma SD-WAN DNS Service can support multiple zones acting as an authoritative server while providing support for all DNS record types.

Internet-Local Resolution

SaaS applications rely upon local DNS resolution to connect an end user with the closest node for any given application. In most cases, you can configure the private network machines to use private centralized DNS servers in a data center or other central locations. These centralized DNS servers rely on DNS systems upstream for authoritative information for zones outside of their responsibility.

Consuming SaaS applications can result in resolution for nodes (local nodes to the central DNS servers and not the branch office users).

Since Prisma SD-WAN can configure the DNS Service to send domain name resolution requests to one set of servers and other domain name resolution requests to a different set of servers, this solves the local DNS resolution. This is particularly useful for SaaS applications that rely on local DNS resolution for optimal node selection.

Secure DNS (DNSSEC)

Secure DNS (DNSSEC) attacks are a standard method to facilitate the interception of traffic. You may deploy the Secure DNS (DNSSEC) to mitigate the threat of a DNS-based attack. DNSSEC adds a layer of trust to DNS by enforcing authentication through the use of digital signatures. These signatures use public-key cryptography.

The Prisma SD-WAN DNS Service can act in one of two DNSSEC modes:

DNSSEC Proxy—In this operation mode, the Prisma SD-WAN DNS Service will proxy secure DNS requests received from a client to DNS servers configured for lookup. When the upstream DNS server generates responses, the AD (Authenticated DNS) flag in the responses is proxied by the Prisma SD-WAN DNS Service to the client.

DNSSEC Server—In this operation mode, the Prisma SD-WAN DNS Service will validate DNS replies and cache DNSSEC data. You must add appropriate trust anchors to the configuration to enable this service, and any upstream DNS servers must be capable of handling DNSSEC requests.

IoT DNS

In many cases, outside vendors manage IoT (Internet of Things) devices and not by the network or application owners. The Prisma SD-WAN DNS service can control domain name resolution on a source address basis. This is further secure by combining the Prisma SD-WAN DNS Services with the Prisma SD-WAN ZBFW.

DNS Accounting

In some environments, both enterprise and carrier, it must pass specific client metadata to the DNS server for accounting purposes. You may configure the Prisma SD-WAN DNS Service to send specific client attributes to the DNS server, including client MAC address, element name, element ID, and other custom text.

Configure the DNS Service on the Prisma SD-WAN Interface

Configure System for DNS Survivability