Configure a DNS Proxy

Configure DNS Proxy Profiles

To create a DNS proxy profile:

1. Click Configure in the left menu bar to open the Configure dashboard.
2. Hover over the device in the honeycomb, and then click Configure to open the site information window.
   
   
    
3. Select the DNS Proxy tab.
   
   
    
4. In the Profile tab, click to display the DNS Proxy > Profile > Add screen. Enter information for the following fields.
   
   
    

   Field	Description
   Profile Name (Required)	Enter a name for the DNS profile.
   Mode	Select the mode to use to check the availability of the resolver: Failover—Click to redirect the traffic through another resolver if the resolver fails or is not reachable. This is the default Round-Robin—Click to use a round-robin method to send traffic among the resolvers. Default: Failover
   Resolver (Group of Fields)
   Resolver Name (Required)	Enter a name for the resolver profile.
   Device Name	Click and select a device to which to send traffic for DNS resolution.
   Network	Click and select which local WAN or LAN networks to use to proxy a DNS request.
   Mode	Select the mode to use to check the availability of the DNS server: Failover—Click to redirect the traffic through another resolver server if the server configured in resolver fails or not reachable. This is the default. Round-robin—Click to use a round-robin method to send traffic among the resolvers. Default: Failover
   SNAT Pool	Select an SNAT pool to associate with the DNS profile. The address in this pool can be used to create a new proxy session. Click to add an SNAT pool, and enter information for the following fields.   Name (Required)—Enter a name for the SNAT pool. Egress Network (Required)—Select an egress network to associate with the SNAT pool. Click Add, and then click Continue.
   Servers	Select a DNS server to associate with the DNS profile. Click to add a new server, and enter information for the following fields.     Name (Required)—Enter a name for the DNS server. IP Address (Required)—Enter the IP address of the DNS server. The address can be an IPv4 or an IPv6 address. Port (Required)—Enter the port number to use to connect to the DNS server. Monitor (Required)—Select the monitor object to use. Monitor object evaluates the state of the IP addresses configured in the resolver. The DNS proxy responds to DNS query with IPv4 or IPv6 addresses whose monitor status is up. Click to add a new monitor, and enter information for the following fields. Name (Required)—Enter a name for the monitor object. Monitor Type (Required)—Select the type of packets to send to the IP address: DNS ICMP TCP IP Address (Required)—Enter the IP address to monitor. Next Hop—Select the device to use as the next hop. Networks—Select the source network interface. Source Interface—Select the source interface on which to send the probe packets. This interface determines the routing instance through which to send the probe packets. Click Add and then click Continue. Click Add.
   Add Resolver	Click .

5. Click Add, and then click Publish.

Configure DNS Proxy Rules

To create a new DNS proxy rule:

1. Click Configure in the left menu bar to open the Configure dashboard.
2. Hover over the device in the honeycomb, and then click Configure to open the site information window.
3. Click DNS Proxy tab, and then click Rules tab .
   
   
    
4. If necessary, click Reorder Rules to enter rule reorder mode.
   1. To change a rule order, click the rule name and drag it to a different location in the rule set.
   2. Click Publish Reordered Rules to save the changes to the Titan cloud.
   3. By default, the rules are displayed in grid view. To change the view to list, click the list view icon.
   4. To pin the view to grid or list for the login session, use the pin icon.
5. In the Rules tab, click to display the DNS Proxy > Rules > Add screen. Enter information for the following fields.
   
   
    

   Field	Description
   Rule Name (Required)	Enter a name for the DNS proxy rule.
   Description	Enter a text description for the rule. The description can be a maximum of 63 characters.
   Match Criteria	Click Address, Hostname, DNS Header, or User and Group tab to add details for that criteria type. Match criteria details are listed in the Apply Match Criteria for DNS Proxy Rules section.
   Scope (Group of Fields)
   Source Zone	In the Please Select field, click the down arrow. A popup window displays the configured interfaces and tunnels. Select the type: SD-WAN Untrusted Wired LAN Wireless LAN
   Arrow	Choose a connection type: One-way Two-way
   Destination Zone	In the Please Select field, click the down arrow. A popup window displays the configured interfaces and tunnels. Select the type: SD-WAN Untrusted Wired LAN
   Action (Group of Fields)	Configure the action to take when a rule matches.
   Proxy Setting	Click to use proxy settings, and then enter information for the following fields to configure the proxy settings:   Select Profile—Select the name of the DNS proxy profile. Apply Policy-Based Forwarding—Click to look up steering policy rules to determine the path on which to send the DNS query.
   Server Setting	Click to use server settings, and then enter information for the following fields to configure the server settings.     IP Address—For A/AAAA DNS queries, enter the static IPv4 or IPv6 address to send in the response to a DNS query. Monitor—Select the monitor object to use. Monitoring object evaluates the state of the IP addresses configured in the resolver. The DNS proxy responds to DNS query with IPv4 or IPv6 addresses whose monitor status is up. Click to add a new monitor, and enter information for the following fields. Name (Required)—Enter a name for the monitor object. Monitor Type (Required)—Select the type of packets to send to the IP address: DNS ICMP TCP IP Address (Required)—Enter the IP address to monitor. Next Hop—Select the device to use as the next hop. Networks—Select the source network interface. Source Interface—Select the source interface on which to send the probe packets. This interface determines the routing instance through which to send the probe packets. Click Add and then click Continue. Click Add.
   None	Click to take no action.
   Logging (Group of Fields)	Configure log settings.
   None	Click to perform no logging.
   Default	Click to use default logging.
   Custom	Click to configure logging to a customer log server. Based on the rule match, the device may send a large number of log messages.   Click the down arrow in the Please Select field to select a log profile. To create a new custom flow logs profile, click . For more information, see Add Custom Logs Profile.

6. Click Add, and then click Publish.

Apply Match Criteria for DNS Proxy Rules

You can apply the following match criteria types in a DNS proxy rule:

• Address
• DNS header
• Hostname
• User and Group
  
  

To specify the match criteria for a DNS proxy rule:

1. Select the Address tab to display the address window.
   
   
    
2. Click the toggle switch to enter the source or destination IP address, and then click Source.
   
   
    
3. Enter a source IP address in CIDR format, and then click the icon. Click the icon to remove an IP address from the list.
   
   
    
4. Enter a destination IP address in CIDR format, and then click the Add icon. Click the Delete icon to remove an IP address from the list.
   
   
    

To specify hostname match criteria for a DNS proxy rule:

1. Select the Hostname tab to display the Hostname window.
   
   ​​​​
    
2. Click the toggle switch to enter the source or destination hostname, and then click Source.
   
   
    
3. Enter a source hostname, and then click the Add icon. Click the Delete icon to remove a hostname from the list.
   
   
    
4. Enter a destination hostname, and then click the Add icon. Click the Delete icon to remove a hostname from the list.
   
   
    
5. Click Continue.

To specify DNS header match criteria for a DNS proxy rule:

1. Select the DNS Header tab to display the DNS header window.
   
   
    
2. Select the type of query to associate with the rule:
   • A—Click to select an IPv4 query.
   • AAAA—Click to select an IPv6 query.
   • MX—Click to select a mail server query.
3. Query Record—Enter the domain name to match with the query and then click

To specify user and group match criteria for a DNS proxy rule:

1. Select the User and Group tab to display the user and group window.
   
   
    
2. Select a user to bind with the security policy:
   • Any
   • Known
   • Selected
   • Unknown
3. To select a specific user and group, click Selected and then do the following:
   1. In the LDAP drop-down list, select an LDAP user group profile.
   2. Use the search box to search for the user and group, or click the check box next to the user and group name.
      
      
       
4. Click Add.
5. To edit a rule, in the DNS Proxy > Rules tab, click a rule name. Then click Save to save the changes to the Titan cloud.
6. To delete a rule, in the DNS Proxy > Rules tab, click the X. Then click Save to save the changes to the Titan cloud.

Supported Software Information

Releases 10.3.4 and later support all content described in this article.

Additional Information

Add Devices Using Titan Portal
Manage Organization Settings