How to Configure DNS Tunnel Detection in SonicOS 7.1.1

Description

DNS tunneling is a method of bypassing security controls and exfiltrating data from a targeted organization. A DNS tunnel can be used as a full remote-control channel for a compromised internal host. Capabilities include Operating System (OS) commands, file transfers, or even a full IP tunnel. SonicOS provides the ability to detect DNS tunneling attacks, displays suspicious clients, and allows you to create white lists for DNS tunnel detection.

When DNS tunneling detection is enabled, SonicOS logs whenever suspicious DNS packets are dropped.DNS Tunneling settings can be made at the group or unit level.
 
Topics Included are: 
  • Configuring DNS Tunnel Detection
  • Detected Suspicious Client Information
  • Creating White list for DNS Tunnel Detection
  • Deleting White List Entries for DNS Tunnel Detection

Resolution

Configuring DNS Tunnel Detection
To configure DNS tunnel detection
 
  1. Navigate to POLICY | DNS Security | Settings.
  2. Click the DNS Tunnel Detection tab.
  3. Under Settings, select Enable DNS Tunnel Detection to enable DNS tunnel detection.
  4. To block all the DNS traffic from the detected clients, select Block All The Clients DNS Traffic.
  5. Click Accept.

    Image
 
 Detected Suspicious Client Information

  SonicOS displays information about all hosts that have established a DNS tunnel in the Detected Suspicious Clients Info table.
 To view detected suspicious client Information
 
  1. Navigate to POLICY | DNS Security | Settings.
  2. Hover over to the DNS Tunnel Detection tab.
  3. Click on the Detected Suspicious Clients Info tab

    Image
 This table is populated only if DNS tunnel detection is enabled. Hosts are dropped only if blocking clients' DNS traffic is enabled. 


   Image


Creating White list for DNS Tunnel Detection
You can create white lists for IP address you consider safe. If a detected DNS tunnel IP address matches an address in the white list, DNS tunnel detection is bypassed.
 
To create a DNS white list
 
  1. Navigate to POLICY | DNS Security | Settings.
  2. Hover over to the DNS Tunnel Detection tab.
  3. Click on the White List for DNS Tunnel Detection tab.
  4. For each IP address, you want to add to the white list:

    Click +Add. The Add One White Entry dialog displays.
    In the IP Address field, enter the IP address of the domain to be added to the whitelist.
    Click Save.

    Image

Deleting White List Entries for DNS Tunnel Detection
To delete all white list entries for DNS tunnel detection
 
  1. Navigate to POLICY | DNS Security | Settings.
  2. Hover over to the DNS Tunnel Detection tab.
  3. Click on the White List for DNS Tunnel Detection tab.
  4. Select an entry to delete or select the top checkbox next to the IP Address column to select all of the items.
  5. Click Delete.

To delete white list entry, click on the entry and click on DELETE.

Related Articles

  • SonicOS 8.1.0 FAQ
    Read More
  • SonicWall GEN8 TZs and GEN8 NSas Settings Migration
    Read More
  • Getting started with SonicWall firewalls
    Read More

Categories

Firewalls
NSa Series
Networking
not finding your answers?
Ask the Community