Implementing Infoblox DNS Firewall

DEPLOYMENT GUIDE

Implementing Infoblox DNS Firewall.

© 2017 Infoblox Inc. All rights reserved. Implementing Infoblox DNS Firewall January, 2017 Page 2 of 21

Contents

Introduction ....................................................................................................................................... 3

Configure Local RPZ. ................................................................................................................. 5

Configure RPZ Feed with Infoblox Threat Intelligence Feed. .................................................. 13

Troubleshooting ....................................................................................................................... 21

© 2017 Infoblox Inc. All rights reserved. Implementing Infoblox DNS Firewall January, 2017 Page 3 of 21

Introduction

Infoblox DNS Firewall employs DNS RPZs (Response Policy Zones), a technology developed by ISC (Internet

System Consortium) for allowing reputable sources to dynamically communicate domain name reputation so you

can implement policy controls for DNS lookups.

This deployment guide shows how to deploy DNS Firewall.

Data Flow for DNS Firewall

4. Infection – Malicious payload is downloaded and infects the user’s system with malware.

5. Execution – The malware calls home with sensitive data or attempts to extort the user for money

(ransomware).

*source: Sophos.com

Step 5 is where DNS firewall gets involved. The malware performs a command and control step to steal sensitive

data. In order to talk to the command and control server, the malware makes a call to the DNS to resolve the

name of the command and control server. With DNS firewall and its local reputation entries and/or reputation

entries from a reputation feed, the DNS resolution can be blocked or redirected to a walled garden website. With

Infoblox, indications of a reputation hit can be seen in the syslog (i.e. CEF messages) or DNS RPZ report from

the reporting server. At this point, the workstation can be tracked down via IP address, username, and switchport

© 2017 Infoblox Inc. All rights reserved. Implementing Infoblox DNS Firewall January, 2017 Page 4 of 21

reputation feeds like Spamhaus.

 Infoblox NIOS 8.0 or later is recommended.

Types of RPZs

 Local RPZ–A local RPZ is a zone that allows administrators to define multiple response policies locally.

Query responses sent are based on the defined rules.

 RPZ Feed–An RPZ feed receives response policies from external sources. DNS clients receive

responses based on the imported rules from a reputable source.

 FireEye integrated RPZ–By integrating the NIOS appliance with the FireEye appliance, you can detect

malware and APTs and take necessary actions to mitigate those threats by importing updates from

FireEye appliance into a FireEye RPZ.

identified.

 Infoblox recommends that you preview your RPZ rules to ensure ruleset integrity and to avoid unexpected

results. You can preview your rules by selecting Log Only (Disabled) when you configure Policy Override

for an RPZ, RPZ feed, or FireEye integrated RPZ.

 The appliance logs all matching and disabled rules for all queries in the syslog. You can view the syslog

to ensure that the rules are set up correctly before they take effect. Ensure that you enable RPZ in the

Logging Category of Grid DNS Properties editor to log these events.

 You can use the standard TSIG mechanism to ensure that feed zones come from the correct servers.

Grid members can function either as a primary or secondary servers for the RPZ. As with hosting any

zone as a secondary, please ensure that the appliance is sized properly to hold the zone contents in

 The name of the zone, which is assigned to an RPZ member, must not exceed 256 characters. The name

can be a combination of alphanumeric characters. When the name exceeds this limit, respective zone

fails to load.

Best Practices for FireEye Integrated RPZs

Before you configure a FireEye integrated RPZ, consider the following:

 FireEye integrated RPZs inherit default values from local RPZs. You can create, edit and delete rules

using the Infoblox GUI, API, and RESTful API.

 To avoid false positives, Infoblox recommends that you create a whitelist of allowed zones using a local

RPZ that is sorted above the FireEye RPZ and add your own domain to the whitelist RPZ. For example,

you can add your company domain name, such as corp100.com. This list must contain popular domains,

© 2017 Infoblox Inc. All rights reserved. Implementing Infoblox DNS Firewall January, 2017 Page 5 of 21

 You cannot add a FireEye integrated RPZ during a scheduled full upgrade. However, updates to the

CNAME record are processed during a full upgrade. NIOS updates CNAME records in the database to

store information that is specific to FireEye alerts.

 The rules created due to insertion of alerts will be visible through the FireEye RPZ viewer. Infoblox

recommends that you do not modify any internal objects. For more information, see Viewing RPZs on

page 1690.

 Note that SSL certificate validation is not supported.

 You must verify the following after you configure the FireEye and NIOS appliances:

o The URL configured on the FireEye appliance matches the URL in the FireEye integrated RPZ on

NIOS.

day.

Deployment Summary

 Install a valid RPZ license. Refer to the Infoblox NIOS administrators guide for more information.

 Enable recursion for your DNS view in which you want to deploy RPZs.

 Configure RPZ logging to ensure all matching and disabled rules for all queries are logged in the syslog.

Refer to the Infoblox NIOS administrator guide for more information.

 Configure RPZs.

Deployment Instructions

1. Log into the Infoblox GUI.