DNS security from Palo Alto

Question

Dears.

please answer please do not route me to infoblox PS support or partner support,

i have two questions related to DNS security perspective

* In my organization i have palo alto DNS security sunscription why i need to have infolox devices (Pls do not answer with  IPAM and DHCP features i totally agree they are making much difference pls focus of DNS part only).
* I have my DNS entries controlled by domain registrar why i need to take headache of managing and controlling security on my premises. 
* If i m buying DNS firewall license from infoblox what are the best that i can configure to use the device efficiently , Please route me to documentation.

Thannks

Laura203 · Answer

You have two different scenarios:

1. Users inside your network wanting to resolve Internet names

2. Clients outside your network wanting to resolve your authoritative names

For traffic heading out of your network, you want to prevent users from getting to malicious sites and you want to prevent DNS based data exfiltration. (I mean, security-wise. You also want fast resolution, from an experience point of view.)

For traffic coming to you, as in the case of registered domains, you want to protect your network and devices from attack and provide 100% uptime with fast resolution globally (if you have a global 'audience').

To be honest, unless you have multiple data centers globally or are only in a regional market, it generally doesn't make sense to host your own public facing DNS. I think Infoblox is missing out on the opportunity to provide public DNS like registrars do, but I'm not privy to their internal discussions.

As an enterprise, we do have multiple data centers and it still makes sense for us to leverage another provider as secondary for our public domains. There are several reasons for that, one of which is having faster resolution in regions where we do not have a data center. AsiaPac is notorious for high latency and we have customers pretty much everywhere, so it helps improve their experience. It also gives us greater resiliency, as they have far more equipment deployed than we ever have planned.

If we did not already have/need the infrastructure to support the load we see with our public DNS (~800 domains), I would not have recommended that we provide public facing DNS using on-prem Infoblox.

So, what do we gain by having DNS on-prem? Primarily control. We have a single interface for our operations teams, which is huge when you have a large organization with enough turnover to make complex designs burdensome to train.

Some of the specific things we gain by not using our registrar or other 3rd party provider (individual items might be available, but not in totality):

* Ability to control authorization mechanisms
* Integration with existing role based authentication solutions
* Single sign-on (SSO) 
* Management limited to internal network (0% chance of someone outside the organization socially engineering access)
* Granular access control to zones and records
* anycast addressing
* Shared records (creating a single record that's applied to multiple zones)
* DNS association with public IPs (host records)
* Dynamic update ability
* DNSSEC
* Record scavenging
* Extensible Attributes (metadata)

bhansmann · Answer

If I am understanding question #2 correctly, you do not need to have your own DNS resolver to do much of the type of DNS security discussed on this thread. To take advantage of BloxOne Threat Defense to block threat activity at the DNS level, you can simply direct DNS requests through the service and set up your policies in the cloud. You do not need to install anything on-premises.

With that said, there is a great deal of flexibility to how you can deploy and use Infoblox DNS security including options that do involve on-premises VMs or hardware. There are organizations and industries that prefer the level of direct control they get from having on-prem components. Or they may already be using other on-premise capabilities from Infoblox like IPAM or DHCP, which offer certain security benefits in addition to their core network functions. (Note that BloxOne DDI is offering increasingly more of these capabilities in the cloud as well.) But none of this is required as the DNS security solution is 100% cloud-native.

I hope this helps. But, if I am misunderstanding your question, please feel free to expand. Or you may be to a point where it may be more useful to have a live discussion with someone who can help you understand the options available for your specific situation.

adamgibs7 · Answer

Dears

Awaiting for the answer for question no 2

thanks