Securing Your Network with DNS over HTTPS (DoH) and Palo Alto Networks Firewalls

DNS over HTTPS (DoH) is an increasingly popular method for encrypting DNS queries, enhancing user privacy and security. However, integrating DoH into your network, particularly when using a Palo Alto Networks firewall, requires careful consideration and configuration. This article explores the complexities and best practices for implementing DoH with Palo Alto Networks firewalls, focusing on security, performance, and manageability.

Understanding DNS over HTTPS (DoH)

Traditional DNS uses plain text, making it vulnerable to eavesdropping and manipulation. DoH encrypts DNS queries and responses using HTTPS, protecting them from unauthorized access. This prevents your ISP or other network observers from seeing which websites you visit. While offering improved privacy, DoH also presents challenges for network administrators seeking to maintain control and visibility.

Challenges of DoH with Palo Alto Networks Firewalls

The encrypted nature of DoH poses challenges for security devices like Palo Alto Networks firewalls. Traditional DNS inspection methods, such as DNS filtering and security analysis, are hindered by the encryption. This means that without proper configuration, your Palo Alto firewall might not be able to effectively:

• Block malicious domains: The firewall won't be able to inspect the DNS queries to identify and block requests to known malicious websites.
• Enforce security policies: Policies based on DNS traffic will be less effective.
• Detect and prevent DNS tunneling: Malicious actors might use DoH to bypass security controls.
• Monitor network activity: Reduced visibility into DNS traffic can make it harder to troubleshoot network issues and detect security incidents.

Integrating DoH with Palo Alto Networks: Solutions and Best Practices

Palo Alto Networks offers several methods to address these challenges:

1. DNS Security Profile:

This allows some level of inspection of DNS traffic, even with DoH. By configuring a DNS Security profile with the appropriate settings, you can have some level of control and visibility, although it might not be as comprehensive as with traditional DNS.

2. Proxy Servers:

Deploying a forward DNS proxy server on your network allows you to intercept and inspect DNS traffic before it's encrypted with DoH. This provides a central point for implementing DNS filtering and security features. The proxy server needs to be configured to forward the requests using DoH to a chosen DoH provider.

3. Using Palo Alto Networks' DNS Security features:

Palo Alto Networks firewalls provide built-in DNS security features that can work in conjunction with DoH. Explore features like URL filtering, threat prevention, and advanced malware protection to mitigate some of the risks associated with DoH.

4. Client-side configuration:

Configure client devices to utilize a corporate-managed DoH resolver. This ensures that your DNS traffic goes through your infrastructure, allowing for policy enforcement and visibility.

Monitoring and Logging

Effective monitoring and logging are crucial when implementing DoH. While complete visibility is more difficult, you can still gather valuable data. Focus on monitoring events related to DNS security profiles, proxy server logs, and security events from your Palo Alto Networks firewall to detect and respond to potential threats.

Conclusion

Implementing DoH with Palo Alto Networks firewalls requires a balanced approach to ensure both enhanced privacy and continued security. By carefully selecting and configuring the right methods, including DNS Security Profiles, proxy servers, and leveraging Palo Alto's built-in capabilities, you can achieve a solution that meets your organization's security and privacy requirements. Remember that ongoing monitoring and adapting your strategy based on evolving threats are essential for maintaining a secure network in the age of DoH.