Create a DNS Security and ETI Profile

Create a DNS security profile to configure feeds and a threat score to list the domains that are known to be connected to malicious activity.

To create a DNS Security and ETI Profile:

Select Configure > Firewall Policy > DNS Security & ETI Profile.
The DNS Security & ETI Profile page is displayed.
Click the + icon.
The Configure DNS Security & ETI Profile page is displayed.
Configure the values according to the guidelines provided in Table 1.
Click OK.
You can view the created profile on the DNS Security & ETI Profile page.

Table 1: Create DNS Security and ETI Profile
Fields	Description
Name	Enter a name for the DNS profile. The name must be a unique string of alphanumeric and special characters; 63-character maximum. Special characters such as < and > are not allowed.
DGA Detection	Enable DNS Domain Generation Algorithm (DGA) to generate random domain names that are used as rendezvous points with potential C&C servers.
Action	Select an action that Security Director must perform when malicious traffic is detected. Deny—Drops the tunnel session. Sinkhole—Drops the tunnel sessions and sinkholes the domain. Permit—Permits the tunnel session.
Logs	Select the logging action that Security Director must perform when malicious traffic is detected. Log Everything—Generates log for each DNS request and DNS detections. Log Detections—Generates log only for malicious DNS detections.
Verdict-timeout	Select a time in milliseconds to wait for a verdict on DNS packet. The range is 50 to 500 milliseconds. The default timeout value is 100 milliseconds.
Fallback-options-log	Enable the fallback option for DNS DGA detection. The fallback options are triggered if DGA verdict is not received within the verdict-timeout configured value. The available option is to log the DNS request.
Tunnel Detection	Enable this option to detect DNS tunneling. DNS tunneling is a cyber-attack method that encodes the data of other programs or protocols in DNS queries and responses. It indicates that DNS traffic is likely to be subverted to transmit data of another protocol or malware beaconing.
Action	Specify the action that SRX Series devices must take when a DNS tunneling is detected. The available options are: Deny—Drops the tunnel session Permit—Permits the tunnel session
Logs	Specify the action taken for DNS tunneling detection. The available options are: Log Everything—Generates log per DNS request and DNS detections. Log Detections—Generates log only for malicious DNS detections.
Inspection-depth	Select the number of packets to be inspected for tunnel detection. The range is 0 through 10. Default is 4 packets.
Fallback-options-Log	Enable the fallback option for DNS tunneling detection. The fallback option is triggered if a tunnel is not detected within the specified number of packets (inspections-depth). The available option is to log the DNS request.
Encrypted Traffic Insight (ETI)	Enable this option to detect malicious threats hidden in an encrypted traffic without intercepting and decrypting the traffic.
Action	The default option is permit (permits tunnel session).
Logs	Select an action for ETI detection: Log Everything—Generates log for each DNS request and DNS detections. Log Detections—Generates log only for malicious DNS detections.
Fallback-options-Log	Enable the fallback option for ETI detection. The fallback option is triggered if an ETI is not detected within the specified number of packets. The available option is to log the DNS request.
Cache TTL	Enable the option to store DNS in cache till time-to-live (TTL).
Benign	Select a benign TTL value. The range is 60 through 172800 seconds. The default value is 86400 seconds.
C2	Select a C2 TTL value. The range is 60 through 172800 seconds. The default value is 86400 seconds.