- CheckMates
- :
- Products
- :
- Quantum
- :
- Security Gateways
- :
- Log DNS query
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Log DNS query
Hello everybody,
Actually we have several gateway clusters in our environment. By default we are logging DNS traffic (UDP 53) but we can see that actually only the connection itself is being logged
Does somebody know how to log the query in the DNS packet? I would like to see the queried domain in the log. I can see that there is a field named "DNS query" and "DNS Query Type" but both are empty so I think it should be an option to enable the gateway to fill that fields.
Thanks
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What is the precise rule that is accepting the traffic?
I suspect it needs to done with an App Control rule (something that logs Detailed or Extended).
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Our goal is having the queried domain name in the DNS logs, so as we can export it to a SIEM (via logexporter) and have the DNS request information, not only the connection.
We have some internal applications that tries to access different services (rare or custom protocols) and URLF/APP CONTROL does not show that information, but if we could log that in the DNS, at least we could see the domain name requested.
Thanks
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
any tip on how to achieve that, @PhoneBoy?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I thought there was an App Control signature that did this, but it doesn't appear there is one.
This is probably an RFE, but it might be worth a TAC case to confirm.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@CheckPoint
Come on,
years go by and such a simple issue is not resolved yet? Top next gen firewall can't cope with so trivial task as DNS queries logging? Are You serious?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you requested a RFE for this?
If you like this post please give a thumbs up(kudo)! 🙂
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, I have - right after Your question.
Thanks for hint.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
what issue? can you please be more specific?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It's all about DNS transactions logging - mainly queries. It's simple UDP 53 plain text. Is there any way to show them in logs? Any sk number or something else?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Maybe this: https://support.checkpoint.com/results/sk/sk116694
Version is EOL but worth a shot.
Although DNS is getting more and more encrypted (the request). Then firewall cannot see it anymore.
If you like this post please give a thumbs up(kudo)! 🙂
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Got it. Please open a TAC request for this.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Let me ask what kind of SIEM do You have? Don't You have network sensor listening on the wire (TAP, port mirroring or promiscous)? Is Your issue resolved by now?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm looking to implement something similar - did you get anywhere with this?
