启用 DNS 隧道检测
要在 SRX 系列防火墙上启用 DNS 隧道检测：
配置 security-metadata-streaming 策略。
set services security-metadata-streaming policy dns_policy dns detections tunneling action <deny| sinkhole|permit> set services security-metadata-streaming policy dns_policy dns detections tunneling notification log set services security-metadata-streaming policy dns_policy dns detections tunneling inspection-depth <value> set services security-metadata-streaming policy dns_policy dns detections tunneling fallback-options notification log set services security-metadata-streaming policy dns_policy dns detections all action <permit | deny | sinkhole> set services security-metadata-streaming policy dns_policy dns detections all notification log set services security-metadata-streaming policy dns_policy dns detections all fallback-options notification log
如果操作设置为沉洞，则配置 DNS 沉洞。请参阅 配置 DNS 沉洞。
层次
[edit services security-metadata-streaming policy dns_policy dns detections]结构级别的配置tunneling选项。security-metadata-streaming { policy dns_policy { dns { detections { tunneling { action [deny | permit | sinkhole]; fallback-options { notification { log; } } inspection-depth value; notification [log | log-detections]; } } } } }将安全元数据流式传输策略附加到区域级别的安全防火墙策略。
set security policies from-zone zone-name to-zone zone-name application-services security-metadata-streaming-policy dns_policy
提交配置。
commit
show services security-metadata-streaming dns statistics使用命令查看安全元数据流式处理策略的 DNS 统计信息。
show services security-metadata-streaming dns statistics Logical system: root-logical-system DNS session statistics: Cache Hits: 0 Cache Misses: 116 C2 Sessions Permitted: 0 C2 Sessions Dropped: 0 C2 Sessions Sinkholed: 12 DNS submission statistics: Domain Submission Success: 43 Domain Submission Failures: 0 Safe Verdicts Received: 8 C2 Verdicts Received: 12 DNS Tunnels Detected: 0 Latency Fallback Triggered: 0 ATP latency statistics: Average Latency: 63ms Maximum Latency: 119ms Minimum Latency: 39ms sub-50ms response: 52 (6%) sub-100ms response: 4000 (88%) sub-250ms response: 30 (4%) sub-500ms response: 2 (2%)
show services dns-filtering cache使用命令查看 DNS 缓存中的详细信息。
show services dns-filtering cache Logical System:root-logical-system DNS Cache Refresh Rate:5 Minutes on FPC0 PIC0 Domain-Name, TTL, Prevalence , Verdict, Hitcount a0.com, 480, 1, C2, 1 Logical System:root-logical-system DNS Cache Refresh Rate:5 Minutes on FPC0 PIC1 Domain-Name, TTL, Prevalence , Verdict, Hitcount a10.com, 480, 1, C2, 1
注意：
Junos OS 21.2R1 及更高版本支持 DNS 隧道检测。