DNS Proxy Object
Table of Contents
Expand All
|
Collapse All
Next-Generation Firewall Docs
-
Cloud Management of NGFWs
- Cloud Management of NGFWs
- PAN-OS 10.0 (EoL)
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0 (EoL)
- PAN-OS 11.1 & Later
- PAN-OS 9.1 (EoL)
-
-
-
- Configure a Filter Access List
- Configure a Filter Prefix List
- Configure a Filter Community List
- Configure a BGP Filter Route Map
- Configure a Filter Route Maps Redistribution List
- Configure a Filter AS Path Access List
- Configure an Address Family Profile
- Configure a BGP Authentication Profile
- Configure a BGP Redistribution Profile
- Configure a BGP Filtering Profile
- Configure an OSPF Authentication Profile
- Configure a Logical Router
- Configure a Static Route
- Configure OSPF
- Configure BGP
- Configure an IPSec Tunnel
- Web Proxy
- Cheat Sheet: GlobalProtect for Cloud Management of NGFWs
-
PAN-OS 10.1
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0 (EoL)
- PAN-OS 11.1 & Later
-
- Tap Interfaces
-
- Layer 2 and Layer 3 Packets over a Virtual Wire
- Port Speeds of Virtual Wire Interfaces
- LLDP over a Virtual Wire
- Aggregated Interfaces for a Virtual Wire
- Virtual Wire Support of High Availability
- Zone Protection for a Virtual Wire Interface
- VLAN-Tagged Traffic
- Virtual Wire Subinterfaces
- Configure Virtual Wires
- Configure an Aggregate Interface Group
- Configure Bonjour Reflector for Network Segmentation
- Use Interface Management Profiles to Restrict Access
-
- DNS Overview
- DNS Proxy Object
- DNS Server Profile
- Multi-Tenant DNS Deployments
- Configure a DNS Proxy Object
- Configure a DNS Server Profile
- Use Case 1: Firewall Requires DNS Resolution
- Use Case 2: ISP Tenant Uses DNS Proxy to Handle DNS Resolution for Security Policies, Reporting, and Services within its Virtual System
- Use Case 3: Firewall Acts as DNS Proxy Between Client and Server
- DNS Proxy Rule and FQDN Matching
-
- NAT Rule Capacities
- Dynamic IP and Port NAT Oversubscription
- Dataplane NAT Memory Statistics
-
- Translate Internal Client IP Addresses to Your Public IP Address (Source DIPP NAT)
- Enable Clients on the Internal Network to Access your Public Servers (Destination U-Turn NAT)
- Enable Bi-Directional Address Translation for Your Public-Facing Servers (Static Source NAT)
- Configure Destination NAT with DNS Rewrite
- Configure Destination NAT Using Dynamic IP Addresses
- Modify the Oversubscription Rate for DIPP NAT
- Reserve Dynamic IP NAT Addresses
- Disable NAT for a Specific Host or Interface
-
- Network Packet Broker Overview
- How Network Packet Broker Works
- Prepare to Deploy Network Packet Broker
- Configure Transparent Bridge Security Chains
- Configure Routed Layer 3 Security Chains
- Network Packet Broker HA Support
- User Interface Changes for Network Packet Broker
- Limitations of Network Packet Broker
- Troubleshoot Network Packet Broker
-
-
Cloud Management and AIOps for NGFW
- Cloud Management and AIOps for NGFW
- PAN-OS 10.0 (EoL)
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0 (EoL)
- PAN-OS 11.1
- PAN-OS 11.2
- PAN-OS 8.1 (EoL)
- PAN-OS 9.0 (EoL)
- PAN-OS 9.1 (EoL)
DNS Proxy Object
When configured as a DNS proxy, the firewall is an intermediary between
DNS clients and servers; it acts as a DNS server itself by resolving
queries from its DNS proxy cache. If it doesn’t find the domain
name in its DNS proxy cache, the firewall searches for a match to
the domain name among the entries in the specific DNS proxy object
(on the interface on which the DNS query arrived). The firewall
forwards the query to the appropriate DNS server based on the match results.
If no match is found, the firewall uses default DNS servers.
A DNS proxy object is where you configure the settings that determine
how the firewall functions as a DNS proxy. You can assign a DNS
proxy object to a single virtual system or it can be shared among
all virtual systems.
- If the DNS proxy object is for a virtual system, you can specify a DNS Server Profile, which specifies the primary and secondary DNS server addresses, along with other information. The DNS server profile simplifies configuration.
- If the DNS proxy object is shared, you must specify at least the primary address of a DNS server.When configuring multiple tenants (ISP subscribers) with DNS services, each tenant should have its own DNS proxy defined, which keeps the tenant’s DNS service separate from other tenants’ services.
In the proxy object, you specify the interfaces for which the
firewall is acting as DNS proxy. The DNS proxy for the interface
does not use the service route; responses to the DNS requests are
always sent to the interface assigned to the virtual router where
the DNS request arrived.
When you Configure a DNS Proxy Object, you can supply
the DNS proxy with static FQDN-to-address mappings. You can also
create DNS proxy rules that control to which DNS server the domain
name queries (that match the proxy rules) are directed. You can
configure a maximum of 256 DNS proxy objects on a firewall. You
must enable Cache and Cache EDNS Responses (under NetworkDNS ProxyAdvanced) if this DNS proxy object
is assigned to DeviceSetupServicesDNS or DeviceVirtual SystemsvsysGeneralDNS
Proxy. Furthermore, if this DNS proxy
object has DNS proxy rules configured, those
rules also need to have cache enabled (Turn on caching
of domains resolved by this mapping).
When the firewall receives an FQDN query (and the domain name
is not in the DNS proxy cache), the firewall compares the domain
name from the FQDN query to the domain names in DNS Proxy rules
of the DNS Proxy object. If you specify multiple domain names in
a single DNS Proxy rule, a query that matches any one of the domain
names in the rule means the query matches the rule. DNS Proxy Rule and FQDN Matching describes
how the firewall determines whether an FQDN matches a domain name
in a DNS proxy rule. A DNS query that matches a rule is sent to
the primary DNS server configured for the proxy object to be resolved.