We have recently added checkpoint and the "suspicious DNS traffic" rule is triggering incidents. We have identified the DC as per the templates but are trying to decrease incidents.
It sounds like you've already started modifying the Approved DNS Servers User Defined Group, so is there traffic in/out on port 53 to any other devices?
yes i have setup all my DCs but i still see traffic in/out on port 53 ... thoughts?
Go to nDepth, and do a search for TCPTrafficAudit.DestinationPort = 53 AND TCPTrafficAudit.DestinationMachine =/= Approved DNS Server UDG
What comes up?
Can I use a connector group vs a UDG for approved DNS server?
Assuming it has all the relevant machines in it, sure. :-)
( ( ( "Event Name" = TCPTrafficAudit ) AND ( DestinationPort = 53 ) ) AND ( ( "Event Name" = TCPTrafficAudit ) AND ( DestinationMachine outside::{ "Windows Server 2003 - DC" } ) ) ) AND ( ( "Event Name" = TCPTrafficAudit ) AND ( DestinationMachine outside::{ "Windows Server 2008/2012 - DC" } ) )
I ran the above, one of the destination machine was the IP of the actual firewall?
Sounds like you need to exempt your firewall from that rule, then. Maybe it's doing some DNS caching at the border?
How would that look like?
