We've been rolling out DNS Security on our Palo Alto NGFWs and have hit a snag. The signatures are flagging a lot of our internal development and tooling sites as malicious, causing legitimate traffic to be blocked.
I'm curious if others have faced this. What's the best way to handle these false positives without just disabling the signatures entirely? Are there specific categories more prone to this, or is tuning the policy with custom allow lists the only real path? Looking for any practical examples of how you've balanced security and usability.
Been there! It's a rite of passage with Palo's DNS Security.
The "Phishing" and "Malware" categories are the usual culprits for internal stuff, especially if your dev sites use oddball domains or IPs in their URLs.
Our path was a mix:
* First, we ran a report to see *which* exact signatures were firing (from the DNS logs).
* Then, we added those specific FQDNs to a custom allow list in the DNS Security profile. We avoided disabling whole categories.
* For internal tool domains we control, we also made sure they had proper reverse DNS set up - that sometimes calms it down.
It's a bit of tuning work upfront, but beats turning it off. You still catch the real bad stuff. 😅