DNS queries from PAN management interface can be triggered by HTTP/TLS Evasion Signatures
42769
Created On 04/08/19 03:32 AM - Last Modified 04/05/24 15:50 PM
Symptom
- A DNS query traffic originating from the management interface of the firewall, this query can be a simple benign query or it can trigger a PaloAlto Networks' signature. These signatures can be spyware or malicious DNS signature.
- This Firewall management IP address is 192.168.10.1, and you will see a DNS query as following.
Environment
- All PAN-OS
Cause
A Firewall configurations can result in Firewall sending a DNS query from the Firewall management interface. Following is a summary of the few reasons; we will cover them one by one on the next page.
-
Spyware Evasion Signature [TID 14978/14984] action is set to "alert/sinkhole"
-
DNS Proxy is enabled
-
Address object as FQDN is configured
-
Report with DNS resolver is configured
-
Monitor tab-> traffic-> Resolve hostname
Spyware Evasion Signature [TID 14978/14984] action
1. Upon filtering with the Threat ID, we see traffic from an internal machine (10.10.10.10) is matching the same signatures.
2. On checking the anti-spyware profile mapped to the Security Policy, HTTP/TLS Evasion Signatures (14978/14984) are set to "Alert."
Another possibility is that the signature has not been defined to 'alert' in an Exception, but that is being instructed to 'alert' from the Anti-Spyware rules:
3. This happens as the internal machine tries to reach out to the malicious website over HTTP. The DNS Signature is triggered when the internal machine makes a DNS resolution.
Explanation:
- The purpose of these signatures is to alert to instances where a client connects to a domain other than the domain specified in a DNS query. Evasion signatures are effective only when the firewall can act as a DNS Proxy and resolve domain name queries.
- In the case of HTTP, the Firewall will resolve the domain name to the IP address and check if the client's destination IP is the same as it has resolved.
- In the case of TLS, the Firewall will read the SNI name from the certificate, and compare the client's destination IP to what it has resolved.
- In both cases, Firewall must resolve the destination IP address to compare with the client's destination address. That is why Firewall originates the DNS query for the domain requested by the client.
The firewall's management interface will issue another DNS query to resolve the domain since anti-spyware signatures 14978 and 14984 are enabled in the above case.
If the domain is malicious, you will notice a malicious or C2 domain DNS query was issued from the Firewall's management interface, which can trigger a security alert in any of the upstream security devices if present.
NOTE: If your firewall management traffic is going through the data plane, you will notice a threat log.
Resolution
- This is an expected behavior based on this configuration, and it will happen if the DNS Signatures are configured to Alert/Sinkhole (if the Sinkhole IP traffic is routed to the firewall). This will not happen if the DNS Signatures are configured to "block" as HTTP or HTTPS traffic never gets triggered because the DNS resolution never succeeds.
- If DNS Signatures are configured as alert/Sinkhole, the Security Policy can be configured with an anti-spyware profile that does not match the DNS Signature for traffic from the firewall management interface to mitigate this issue.
NOTE: The management interface will also initiate a DNS Query to resolve the IP address of any malicious domain that's added as FQDN Object (Objects>Address) in the firewall and used in a security policy. This query will repeat every 30 minutes if the DNS Query gets blocked. The solution for this is to delete the FQDN Objects and block connections to these domains using DNS Security/DNS Signatures and URL filtering.
Additional Information
The management interface will also initiate a DNS Query to resolve the IP address of any domain in the following conditions.
- DNS Proxy is enabled.
- FQDN objects:
- FQDN object is configured in objects-> Address in firewall and it is used in a security policy and it checked every 30 minutes.
- Monitor tab-> traffic-> Resolve hostname
- Reporting: In the pre-defined reports, those are enabled by default, the reporting engine tries to resolve the IP address of the malware domain for URL filtering logs reports for botnet and malicious URL/domains.