Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Collaborator

DNS Passive Learning Design Question

In regards to the new R80.40 feature, DNS Passive Learning, I'm curious if all DNS requests can be watched or only certain ones.  sk161612 talks about using the same resolver as the gateway or configuring a setting in an object to mark it as a DNS server, but in this scenario, the firewall sees the needed DNS requests, just FROM the DNS servers making the recursive request to the internet.  It does NOT see the request between the client and the DNS server.  I don't know what recursive servers are on the internet, so I can't create objects there.  Can the gateway watch the DNS between the DNS server AND the internet?

 

Annotation 2020-03-04 213858.jpg

0 Kudos
8 Replies
Highlighted
Admin
Admin

Only the requests to known DNS servers can be watched.
The reason for this is that DNS requests could traverse the gateway that are going to malicious DNS servers.
We assume the gateway is using a "trusted" DNS server.
Any other DNS server defined as described in sk161612 is considered trusted.
FYI, the list and IPs of the root name servers is well known and published: https://www.iana.org/domains/root/servers
What your internal DNS server is using is a different matter, and I assume whoever manages your DNS server can tell you that.
0 Kudos
Highlighted
Collaborator

What about requests FROM known DNS servers?  Can those be watched?

0 Kudos
Highlighted

Hi @Brian_Deutmeyer 

DNS Passive Learning is a mechanism for constructing an IP / domain cache in which DNS traffic will be inspected and parsed for these purposes. This only works for defined DNS servers in an FW object. In this case the DNS answers are written to the FW DNS cache. It does not work for undefined DNS servers.

DNS Passive Learning is enabled by default in R80.40.

Tags (1)
0 Kudos
Highlighted
Admin
Admin

No, the mechanism will only trust DNS information received from known DNS servers, regardless of who is making the query (a client or a DNS server).
0 Kudos
Highlighted
Participant

Forgive me for asking, but what exactly is DNS Passive Learning from Checkpoint? I've been trying to do some searches both on the forums here, the Checkpoint KB's and the Internet as a whole and I'm getting glimpses of what it's supposed to do, but nothing is completely clear about what it provides? All of my DNS servers are marked as DNS servers on my firewalls as described, so I presume my gateways are using this DNS Passive Learning, but I don't know exactly what that means?
Highlighted
Collaborator

Disclaimer: I don't have this setup as I'm waiting for an additional feature.

Check out sk161612 for more information.

This feature allows you to specify a domain (and the subdomains) to allow access to.  Let's say a source needs access to *.something.biz and there isn't' a relevant application.  You can try to write you own application, but often, that might not be feasible (think non-web encrypted traffic).   The gateway can watch the DNS requests looking for anything that matches something.biz and store the corresponding IPs in its cache.  This way when the rule in question is evaluated, the gateway can check the cache and allow/deny access.  

A domain object won't work here because reverse DNS doesn't exist or doesn't match the site.

An FQDN domain object won't work here because you don't know all the FQDNs that will be called.

 

Make sense?

0 Kudos
Highlighted
Admin
Admin

But, for this feature to work, queries to those trusted DNS servers must traverse the gateway.
Otherwise, we can't "learn" about these mappings passively.
0 Kudos
Highlighted
Explorer

Hello,

I have two questions regarding DNS passive learning:

1) will the DNS-entries, which are learned by DNS passive learning, be replicatet to the standby-member in an Cluster-environment (active/passive)

2) how can I querry the list which is learned by DNS passive learning. Can it be done with the "domains_tool"?

Thank you in advance

Best regards

Sascha

0 Kudos