PaloAltoNetworks / PaloAltoNetworks/pan-os-python
Add Support for DNS Proxy Configuration
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 400
- Forks
- 199
- PR merge metrics
- No merged PRs in 30d
Description
Is your feature request related to a problem?
The pan-os-python SDK currently does not support the configuration of DNS proxy settings. Given the importance of DNS proxying in network security and traffic management, incorporating this feature would greatly enhance the SDK's utility. DNS proxying allows firewalls to act as DNS servers, forwarding queries based on domain names to specified DNS servers, thus improving query efficiency and localization.
Describe the solution you'd like
DNS Proxy Object Management: Ability to create, modify, and delete DNS proxy objects. This includes setting proxy names, specifying interfaces, and defining primary and secondary DNS servers.
Static Entries and Rules: Support for configuring static FQDN-to-IP mappings and DNS proxy rules, allowing for domain-specific DNS query forwarding.
Advanced Settings: Implementation of advanced DNS proxy settings such as caching, TCP/UDP query handling, and EDNS response caching.
Describe alternatives you've considered
Manipulating the XPATH of the configuration of the element directly.
/response/result/config/devices/entry/network/dns-proxy
Additional context
In a typical setup, firewalls configured with DNS proxy can cache queries, adhere to specific rules for domain name resolution, and provide fallback to default DNS servers. This functionality is vital for optimizing DNS traffic and ensuring reliable and secure domain name resolution within network environments.
The addition should include Python methods for configuring each aspect of the DNS proxy, such as creating proxies, setting up rules, and managing advanced settings. Consideration for error handling and validation of DNS settings should also be included to ensure robustness.
Example Payload
<dns-proxy>
<entry name="cdot.io DNS Proxy">
<cache>
<max-ttl>
<enabled>no</enabled>
</max-ttl>
<enabled>yes</enabled>
</cache>
<default>
<primary>94.140.14.14</primary>
<secondary>94.140.15.15</secondary>
</default>
<tcp-queries>
<enabled>no</enabled>
</tcp-queries>
<static-entries>
<entry name="Austin Firewall">
<address>
<member>192.168.255.215</member>
</address>
<domain>austin.cdot.io</domain>
</entry>
<entry name="Dallas Firewall">
<address>
<member>192.168.255.213</member>
</address>
<domain>dallas.cdot.io</domain>
</entry>
<entry name="Houston Firewall">
<address>
<member>192.168.255.211</member>
</address>
<domain>houston.cdot.io</domain>
</entry>
<entry name="DataCenter Firewall">
<address>
<member>192.168.255.1</member>
</address>
<domain>datacenter.cdot.io</domain>
</entry>
<entry name="Panorama">
<address>
<member>192.168.255.210</member>
</address>
<domain>panorama.cdot.io</domain>
</entry>
<entry name="Magnolia Firewall">
<address>
<member>192.168.255.2</member>
</address>
<domain>magnolia.cdot.io</domain>
</entry>
<entry name="Office Switch">
<address>
<member>192.168.255.103</member>
</address>
<domain>office.cdot.io</domain>
</entry>
<entry name="Closet Switch">
<address>
<member>192.168.255.102</member>
</address>
<domain>closet.cdot.io</domain>
</entry>
<entry name="Garage Switch">
<address>
<member>192.168.255.101</member>
</address>
<domain>garage.cdot.io</domain>
</entry>
<entry name="DataCenter Server 7">
<address>
<member>172.16.0.97</member>
</address>
<domain>datacenter-server7.cdot.io</domain>
</entry>
<entry name="DataCenter Server 6">
<address>
<member>172.16.0.96</member>
</address>
<domain>datacenter-server6.cdot.io</domain>
</entry>
<entry name="DataCenter Server 5">
<address>
<member>172.16.0.95</member>
</address>
<domain>datacenter-server5.cdot.io</domain>
</entry>
<entry name="Ansible Automation Platform">
<address>
<member>172.16.0.94</member>
</address>
<domain>ansible.dmz.cdot.io</domain>
</entry>
<entry name="DataCenter Server 3">
<address>
<member>172.16.0.93</member>
</address>
<domain>datacenter-server3.cdot.io</domain>
</entry>
<entry name="DataCenter Server 2">
<address>
<member>172.16.0.92</member>
</address>
<domain>datacenter-server2.cdot.io</domain>
</entry>
<entry name="DataCenter Server 1">
<address>
<member>172.16.0.91</member>
</address>
<domain>datacenter-server1.cdot.io</domain>
</entry>
</static-entries>
<interface>
<member>ethernet1/3</member>
<member>ethernet1/4</member>
</interface>
</entry>
</dns-proxy>
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the configuration XPath /response/result/config/devices/entry/network/dns-proxy and compare it with the supplied XML payload. Define the scope for proxy objects, interfaces, DNS servers, static entries, rules, caching, query handling, and validation; done means each requested configuration aspect is exposed through Python methods with appropriate error handling.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- networking, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100