PaloAltoNetworks / PaloAltoNetworks/pan-os-python

Add Support for DNS Proxy Configuration

Open
#546 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Python
Stars
400
Forks
199
PR merge metrics
No merged PRs in 30d

Description

Is your feature request related to a problem?

The pan-os-python SDK currently does not support the configuration of DNS proxy settings. Given the importance of DNS proxying in network security and traffic management, incorporating this feature would greatly enhance the SDK's utility. DNS proxying allows firewalls to act as DNS servers, forwarding queries based on domain names to specified DNS servers, thus improving query efficiency and localization.

Describe the solution you'd like

DNS Proxy Object Management: Ability to create, modify, and delete DNS proxy objects. This includes setting proxy names, specifying interfaces, and defining primary and secondary DNS servers.
Static Entries and Rules: Support for configuring static FQDN-to-IP mappings and DNS proxy rules, allowing for domain-specific DNS query forwarding.
Advanced Settings: Implementation of advanced DNS proxy settings such as caching, TCP/UDP query handling, and EDNS response caching.

Describe alternatives you've considered

Manipulating the XPATH of the configuration of the element directly.

/response/result/config/devices/entry/network/dns-proxy
Additional context

In a typical setup, firewalls configured with DNS proxy can cache queries, adhere to specific rules for domain name resolution, and provide fallback to default DNS servers. This functionality is vital for optimizing DNS traffic and ensuring reliable and secure domain name resolution within network environments.

The addition should include Python methods for configuring each aspect of the DNS proxy, such as creating proxies, setting up rules, and managing advanced settings. Consideration for error handling and validation of DNS settings should also be included to ensure robustness.

Example Payload

<dns-proxy>
    <entry name="cdot.io DNS Proxy">
        <cache>
            <max-ttl>
                <enabled>no</enabled>
            </max-ttl>
            <enabled>yes</enabled>
        </cache>
        <default>
            <primary>94.140.14.14</primary>
            <secondary>94.140.15.15</secondary>
        </default>
        <tcp-queries>
            <enabled>no</enabled>
        </tcp-queries>
        <static-entries>
            <entry name="Austin Firewall">
                <address>
                    <member>192.168.255.215</member>
                </address>
                <domain>austin.cdot.io</domain>
            </entry>
            <entry name="Dallas Firewall">
                <address>
                    <member>192.168.255.213</member>
                </address>
                <domain>dallas.cdot.io</domain>
            </entry>
            <entry name="Houston Firewall">
                <address>
                    <member>192.168.255.211</member>
                </address>
                <domain>houston.cdot.io</domain>
            </entry>
            <entry name="DataCenter Firewall">
                <address>
                    <member>192.168.255.1</member>
                </address>
                <domain>datacenter.cdot.io</domain>
            </entry>
            <entry name="Panorama">
                <address>
                    <member>192.168.255.210</member>
                </address>
                <domain>panorama.cdot.io</domain>
            </entry>
            <entry name="Magnolia Firewall">
                <address>
                    <member>192.168.255.2</member>
                </address>
                <domain>magnolia.cdot.io</domain>
            </entry>
            <entry name="Office Switch">
                <address>
                    <member>192.168.255.103</member>
                </address>
                <domain>office.cdot.io</domain>
            </entry>
            <entry name="Closet Switch">
                <address>
                    <member>192.168.255.102</member>
                </address>
                <domain>closet.cdot.io</domain>
            </entry>
            <entry name="Garage Switch">
                <address>
                    <member>192.168.255.101</member>
                </address>
                <domain>garage.cdot.io</domain>
            </entry>
            <entry name="DataCenter Server 7">
                <address>
                    <member>172.16.0.97</member>
                </address>
                <domain>datacenter-server7.cdot.io</domain>
            </entry>
            <entry name="DataCenter Server 6">
                <address>
                    <member>172.16.0.96</member>
                </address>
                <domain>datacenter-server6.cdot.io</domain>
            </entry>
            <entry name="DataCenter Server 5">
                <address>
                    <member>172.16.0.95</member>
                </address>
                <domain>datacenter-server5.cdot.io</domain>
            </entry>
            <entry name="Ansible Automation Platform">
                <address>
                    <member>172.16.0.94</member>
                </address>
                <domain>ansible.dmz.cdot.io</domain>
            </entry>
            <entry name="DataCenter Server 3">
                <address>
                    <member>172.16.0.93</member>
                </address>
                <domain>datacenter-server3.cdot.io</domain>
            </entry>
            <entry name="DataCenter Server 2">
                <address>
                    <member>172.16.0.92</member>
                </address>
                <domain>datacenter-server2.cdot.io</domain>
            </entry>
            <entry name="DataCenter Server 1">
                <address>
                    <member>172.16.0.91</member>
                </address>
                <domain>datacenter-server1.cdot.io</domain>
            </entry>
        </static-entries>
        <interface>
            <member>ethernet1/3</member>
            <member>ethernet1/4</member>
        </interface>
    </entry>
</dns-proxy>

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the configuration XPath /response/result/config/devices/entry/network/dns-proxy and compare it with the supplied XML payload. Define the scope for proxy objects, interfaces, DNS servers, static entries, rules, caching, query handling, and validation; done means each requested configuration aspect is exposed through Python methods with appropriate error handling.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
networking, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.