Starting from Junos version 19.3R2 and onwards, user can configure DNS filtering with the MX-SPC3 services card. Next Gen Services are supported on MX240, MX480 and MX960 routers. For DNS request types A, AAAA, MX, CNAME, TXT, SRV, and ANY, you configure the action to take for a DNS request for a disallowed domain. Surprisingly, there is not a working example of DNS filter file in juniper SharePoint website. The only example shared in RLI 35488 document is incorrect due to extra commas and spaces in line hence could not be applied to a MX directly. When configuring DNS filter, if a url-filter file is missing in /var/db/url-filtered/ directory, below commit error will be displayed.
set services web-filter profile test1 global-dns-filter-stats-log-timer 5
set services web-filter profile test1 dns-filter database-file customer-dns-filter.txt
set services web-filter profile test1 dns-filter dns-server 8.8.8.8
set services web-filter profile test1 dns-filter statistics-log-timer 5
set services web-filter profile test1 dns-filter dns-resp-ttl 3600
set services web-filter profile test1 dns-filter wildcarding-level 5
set services web-filter profile test1 dns-filter-template dns1 client-interfaces xe-1/0/1.0
set services web-filter profile test1 dns-filter-template dns1 term 1 from src-ip-prefix 10.20.16.0/24
set services web-filter profile test1 dns-filter-template dns1 term 1 then dns-sinkhole
user@MX480# commit
URLFD_CONFIG_FAILURE: Configuration not valid:Error while parsing the file: /var/db/url-filterd/customer-dns-filter.txt
error: configuration check-out failed
This KB gives a working example of dns-filter database which could be used for testing purpose for MX next gen services.
root@MX480:/var/db/url-filterd # cat customer-dns-filter.txt
20170314_01:domain,sinkhole_ip,v6_sinkhole_ip,sinkhole_fqdn,id,action
www.google.com,10.1.1.1,1004::1,www.googlesink.com,1235,report
www.yahoo.com,10.1.1.1,1004::1,www.yahoosink1.com,1236,replace
juniper.net,10.1.1.225,1004::1,www.juniper.net,1234,replace
www.cnet.com,10.2.2.1,1005::1,www.cnetsink.com,1237,report
www.cnet1.com,10.1.1.1,1006::1,www.cnet1sink.com,1238,replace
www.facebook.com,10.3.3.1,1004::2,www.facebooksink.com,1239,replace
With above dns filter database file presented in /var/db/url-filterd directory, dns filter configure will pass through
user@MX480# commit check
configuration check succeeds
[edit]
commit complete
2024-05-02 : Article Created
2026-06-14 : Mark to be external