Technical Tip: Domain Name threat feed only applicable in DNS filter profile

[Kraven2323]

Description

This article describes that from V6.2 onwards the external block list (threat Feed) in firewall policy can be done. Among one of the categories, Domain name threat feed can be configured.

Solution

It is possible to configure the Domain Name threat feed using the following navigation: Security Fabric -> External Connectors, select 'Create New' -> Threat Feeds -> Domain Name. The Domain Name contains one domain per line. Simple wildcards are supported. It is available as a Remote Category in DNS Filter profiles. Example: mail.*.example.com *-special.example.com www.*example.com example.com The Domain Name threat feed can only be applied to the DNS filter profile. Note : If using local DNS, apply the DNS filter on that local DNS server firewall policy.  For Testing and verifying if the thread feed working or not in the system give primary DNS 8.8.8.8 secondary DNS: blank, so DNS traffic will not go to local DNS. Related document: External resources for DNS filter