Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Support for DNS Proxy Configuration #546

Open
cdot65 opened this issue Jan 27, 2024 · 0 comments
Open

Add Support for DNS Proxy Configuration #546

cdot65 opened this issue Jan 27, 2024 · 0 comments

Comments

@cdot65
Copy link
Contributor

cdot65 commented Jan 27, 2024

Is your feature request related to a problem?

The pan-os-python SDK currently does not support the configuration of DNS proxy settings. Given the importance of DNS proxying in network security and traffic management, incorporating this feature would greatly enhance the SDK's utility. DNS proxying allows firewalls to act as DNS servers, forwarding queries based on domain names to specified DNS servers, thus improving query efficiency and localization.

Describe the solution you'd like

DNS Proxy Object Management: Ability to create, modify, and delete DNS proxy objects. This includes setting proxy names, specifying interfaces, and defining primary and secondary DNS servers.
Static Entries and Rules: Support for configuring static FQDN-to-IP mappings and DNS proxy rules, allowing for domain-specific DNS query forwarding.
Advanced Settings: Implementation of advanced DNS proxy settings such as caching, TCP/UDP query handling, and EDNS response caching.

Describe alternatives you've considered

Manipulating the XPATH of the configuration of the element directly.

/response/result/config/devices/entry/network/dns-proxy

Additional context

In a typical setup, firewalls configured with DNS proxy can cache queries, adhere to specific rules for domain name resolution, and provide fallback to default DNS servers. This functionality is vital for optimizing DNS traffic and ensuring reliable and secure domain name resolution within network environments.

The addition should include Python methods for configuring each aspect of the DNS proxy, such as creating proxies, setting up rules, and managing advanced settings. Consideration for error handling and validation of DNS settings should also be included to ensure robustness.

Example Payload

<dns-proxy>
    <entry name="cdot.io DNS Proxy">
        <cache>
            <max-ttl>
                <enabled>no</enabled>
            </max-ttl>
            <enabled>yes</enabled>
        </cache>
        <default>
            <primary>94.140.14.14</primary>
            <secondary>94.140.15.15</secondary>
        </default>
        <tcp-queries>
            <enabled>no</enabled>
        </tcp-queries>
        <static-entries>
            <entry name="Austin Firewall">
                <address>
                    <member>192.168.255.215</member>
                </address>
                <domain>austin.cdot.io</domain>
            </entry>
            <entry name="Dallas Firewall">
                <address>
                    <member>192.168.255.213</member>
                </address>
                <domain>dallas.cdot.io</domain>
            </entry>
            <entry name="Houston Firewall">
                <address>
                    <member>192.168.255.211</member>
                </address>
                <domain>houston.cdot.io</domain>
            </entry>
            <entry name="DataCenter Firewall">
                <address>
                    <member>192.168.255.1</member>
                </address>
                <domain>datacenter.cdot.io</domain>
            </entry>
            <entry name="Panorama">
                <address>
                    <member>192.168.255.210</member>
                </address>
                <domain>panorama.cdot.io</domain>
            </entry>
            <entry name="Magnolia Firewall">
                <address>
                    <member>192.168.255.2</member>
                </address>
                <domain>magnolia.cdot.io</domain>
            </entry>
            <entry name="Office Switch">
                <address>
                    <member>192.168.255.103</member>
                </address>
                <domain>office.cdot.io</domain>
            </entry>
            <entry name="Closet Switch">
                <address>
                    <member>192.168.255.102</member>
                </address>
                <domain>closet.cdot.io</domain>
            </entry>
            <entry name="Garage Switch">
                <address>
                    <member>192.168.255.101</member>
                </address>
                <domain>garage.cdot.io</domain>
            </entry>
            <entry name="DataCenter Server 7">
                <address>
                    <member>172.16.0.97</member>
                </address>
                <domain>datacenter-server7.cdot.io</domain>
            </entry>
            <entry name="DataCenter Server 6">
                <address>
                    <member>172.16.0.96</member>
                </address>
                <domain>datacenter-server6.cdot.io</domain>
            </entry>
            <entry name="DataCenter Server 5">
                <address>
                    <member>172.16.0.95</member>
                </address>
                <domain>datacenter-server5.cdot.io</domain>
            </entry>
            <entry name="Ansible Automation Platform">
                <address>
                    <member>172.16.0.94</member>
                </address>
                <domain>ansible.dmz.cdot.io</domain>
            </entry>
            <entry name="DataCenter Server 3">
                <address>
                    <member>172.16.0.93</member>
                </address>
                <domain>datacenter-server3.cdot.io</domain>
            </entry>
            <entry name="DataCenter Server 2">
                <address>
                    <member>172.16.0.92</member>
                </address>
                <domain>datacenter-server2.cdot.io</domain>
            </entry>
            <entry name="DataCenter Server 1">
                <address>
                    <member>172.16.0.91</member>
                </address>
                <domain>datacenter-server1.cdot.io</domain>
            </entry>
        </static-entries>
        <interface>
            <member>ethernet1/3</member>
            <member>ethernet1/4</member>
        </interface>
    </entry>
</dns-proxy>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant