3.1. Using SSL Orchestrator with DNS-over-HTTPS Guardian

3.1.1. Challenge

Your company is adopting DNS-over-HTTPS (DoH) to protect users against DNS eavesdropping and tampering. At the same time, DoH blinds traditional network security tools and can let applications bypass enterprise DNS policies. The CISO has asked you to design a solution that restores visibility and control, and provides a method to block or allow DoH requests based on URL category.

3.1.2. Solution

The F5 SSL Orchestrator Service Extension DoH Guardian is a function for monitoring/managing DNS-over-HTTPS traffic flows and detecting potentially malicious DoH exfiltration over a L3 Outbound Proxy. This Service Extension is invoked at a detected (and decrypted) DNS-over-HTTPS request and has several options for logging, management, blocking, and anomaly detection.

You will be enabling the capability to inspecting DoH requests and applying controls to block (blackhole or sinkhole) or allow based on the DoH request URL category.