Enable DNS Tunnel Detection

To enable DNS tunnel detections on SRX Series Firewalls:

1. Configure the security-metadata-streaming policy.

   content_copy zoom_out_map

   set services security-metadata-streaming policy dns_policy dns detections tunneling action <deny| sinkhole|permit>
   set services security-metadata-streaming policy dns_policy dns detections tunneling notification log
   set services security-metadata-streaming policy dns_policy dns detections tunneling inspection-depth <value>
   set services security-metadata-streaming policy dns_policy dns detections tunneling fallback-options notification log
   set services security-metadata-streaming policy dns_policy dns detections all action <permit | deny | sinkhole>
   set services security-metadata-streaming policy dns_policy dns detections all notification log
   set services security-metadata-streaming policy dns_policy dns detections all fallback-options notification log
   

   Configure DNS sinkhole if the action is set as sinkhole. See Configure DNS Sinkhole.

2. Configure tunneling option at [edit services security-metadata-streaming policy dns_policy dns detections] hierarchy level.

   content_copy zoom_out_map

   security-metadata-streaming {
       policy dns_policy {
           dns {
               detections {   
                   tunneling {
                       action [deny | permit | sinkhole];
                       fallback-options {
                           notification {
                               log;
                           }
                       }
                       inspection-depth value;
                       notification [log | log-detections];
                    }
               }
           }
        }
   }
   

3. Attach the security-metadata-streaming policy to a security firewall policy at zone-level.

   content_copy zoom_out_map

   set security policies from-zone zone-name to-zone zone-name application-services security-metadata-streaming-policy dns_policy

4. Commit the configuration.

   content_copy zoom_out_map

   commit

Use the show services security-metadata-streaming dns statistics command to view the DNS statistics of security metadata streaming policy.

show services security-metadata-streaming dns statistics
Logical system: root-logical-system
DNS session statistics:
  Cache Hits:                0
  Cache Misses:              116
  C2 Sessions Permitted:     0
  C2 Sessions Dropped:       0
  C2 Sessions Sinkholed:     12

DNS submission statistics:
  Domain Submission Success:   43
  Domain Submission Failures:  0
  Safe Verdicts Received:      8
  C2 Verdicts Received:        12
  DNS Tunnels Detected:        0
  Latency Fallback Triggered:  0

ATP latency statistics:
  Average Latency:             63ms
  Maximum Latency:             119ms
  Minimum Latency:             39ms
  sub-50ms response:           52 (6%)
  sub-100ms response:          4000 (88%)
  sub-250ms response:          30 (4%)
  sub-500ms response:          2 (2%)

Use the show services dns-filtering cache command to view the details within the DNS cache.

show services dns-filtering cache
Logical System:root-logical-system
DNS Cache Refresh Rate:5 Minutes on FPC0 PIC0
Domain-Name, TTL, Prevalence , Verdict, Hitcount
a0.com, 480, 1, C2, 1

Logical System:root-logical-system
DNS Cache Refresh Rate:5 Minutes on FPC0 PIC1
Domain-Name, TTL, Prevalence , Verdict, Hitcount
a10.com, 480, 1, C2, 1